Profile update accepts any field

What is the security bug in this profile update handler?

export async function PATCH(req: Request) {
  const session = await auth()
  if (!session) return new Response(null, { status: 401 })
  const body = await req.json()
  await db.user.update({
    where: { id: session.user.id },
    data: body,
  })
  return Response.json({ ok: true })
}