AES-CBC ciphertext manipulation with known IV and plaintext!
This question is educationally illustrative and deserves a good answer. 

Because in CBC, $C_i = E_k(C_{i-1} \oplus P_i)$, and $C_0 = IV$, you can alter any bit in the first block by changing $IV$ without affecting later blocks and won't get caught because there isn't a MAC tag. 

Take a look at this graph: 

0123456789abcdef // numbering
{"admin": 0, "us // json token
ivivivivivIviviv // init vec
~~~~~~~~~~^~~~~~ // change


This shows once again why message authentication is important, and symmetric-key encryption should follow AEAD paradigm.