Generate a CSRF payload, setting role value to 50 (Global Administrator) Lure the administrator to click a button on an attacker-controlled domain. Profit??
