Many bugs, however complicated their root cause might be, display themselves as a normal user having powers that were meant only for admin.

Generally, anything that "admin" is the only group allowed to do that "user" has access to is considered bad. Test everything, attack admin functionality as a normally priv'd user.

If you see the word admin, you're probably on the right track.

Also, always try admin:admin on everything you touch.