Mass assignment in profile update

The profile form sends PATCH /api/me with name and phone. You add an extra field to the JSON body and the response shows your account is now an admin. What is this vulnerability?

PATCH /api/me
Content-Type: application/json

{ "name": "Sara", "phone": "+971501234567", "role": "admin" }