The approval workflow can be bypassed by modifying client data, allowing unauthorized approvals.
Server-side validation enforces the approval process preventing unauthorized actions.