Account Takeover Using CSRF(json-based)

I was hunting on Bugcrowd private program. The program has 4 different
kind of roles Like Admin, H-User, L-User, and Guest. First I log in with the
admin account and start testing every functionality.