SystemGroup group-name [ ... group-name ]
Specifies the group(s) to use for @SYSTEM group authentication. The
default contains "admin", "lpadmin", "root", "sys", and/or "system".
cups-daemon package on Debian ships with a default for
SystemGroup root lpadmin
(most probably from compilation options)
One can authenticate with an user in this group on the web page to gain administrative privileges through the CUPS GUI.
So this will be enough:
sudo adduser $USER lpadmin
Now after being authenticated using
$USER and its password in the web session (even if authentication has already been done in the current web session and led to a Forbidden message), the administrative web menus are accessible (logout/login of the desktop user is not even needed: this is over TCP, so there's no local user credential considered, only the target user is considered).