RBAC role escalation via mass assignmentmediumnot started
A profile-update API blindly binds every submitted field to the user object, including role. Promote yourself to admin (mass assignment) and read the admin-only flag.
loading simulator…
1. Log in as the normal user. The profile form posts display_name to /api/profile. Add an extra field role=admin to the POST body (curl or DevTools). Why: the endpoint copies all submitted keys onto your account record, so an unexpected role field overwrites your privilege level.
2. Now /admin is authorized and returns the flag.
Lesson: bind only an explicit allow-list of fields; never let clients set privilege attributes.