Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form?
Assume a form processor that has multiple HTML forms which submit to it. One form only has 5 fields, a more 'privileged' form might have 10. Nothing prevents the client from submitting all 10 fields by editing the 5-field form, except that they don't know the fields without having seen both forms.
So in this case, the web app developer is attempting to control access to certain functions by excluding specific form fields from a page. Can a user identify which fields are available, but not shown, if they only have access to the limited version of the form?
If the answer is "only through guessing" then is this "security" model considered security through obscurity?
OP Edit - Hopefully adding some clarity.
One application I work with is segmented into multiple modules available to admins for various functions. Admins can be granted access to modules on an individual basis (eg adminA can be given access to module1 and module3 and not given rights to module2). The application then allows admin rights to be managed on a more granular level by adjusting view/edit rights by individual items within the module. However, I have realized that the read only permission is controlled (on client-side only) by disabled form fields and the exclusion of form fields. By knowing the ID of a missing field, I can submit and change values even if the field is not in the page’s source. I can exploit this because I know the name of the missing fields, but how vulnerable is the application to exploitation by individuals who are unaware of the missing field names?