#0205
Your registration endpoint creates a new user from the incoming request body. The handler spreads the entire payload into the new user object, trusting that clients will only send name, email, and password.
An attacker adds 'isAdmin: true' to the registration payload. Because the handler never strips this field, the freshly created account has full admin privileges from the moment of registration.
Admin flag injection through registration is a classic first-day vulnerability. If not caught in code review, it can go live and allow any registrant to become an administrator.
registerUser({ name: 'Eve', email: 'eve@x.com', isAdmin: true }, db)// returns { isAdmin: false }