Mass assignment (BOPLA)

When it applies

An endpoint deserializes client JSON straight into a data object without an allowlist of writable fields. You add sensitive properties the developer never meant to be client-writable.

Why it works

Frameworks that auto-bind request bodies to models will set any matching attribute unless explicitly restricted. If role, isAdmin, account_balance, email_verified, or user_id are bindable, you set them by just including them in the body.