From Dev.to
🧬 Mass Assignment: One Extra JSON Field That Turns Users into Admins
Some API bugs don't need a payload. No quotes, no angle brackets, no encoding tricks. Just one extra field in a JSON body that the developer never expected anyone to send: {"name": "Alice", "role": "a...