#0604
Your registration endpoint deserialises a JSON body and spreads all parsed fields directly into a user profile object.
An attacker adds extra fields like `isAdmin: true` or `role: 'admin'` to the JSON body. Because no allowlist is applied, these fields land directly in the stored profile, granting escalated privileges.
Mass assignment vulnerabilities have led to account takeovers and privilege escalation at major platforms. Always allowlist the fields you accept — never blocklist the ones you want to reject.
buildUserProfile('{"name":"alice","isAdmin":true}')// returns: {name:'alice', email:'', bio:''} — isAdmin absent
buildUserProfile('{"name":"alice","email":"a@b.com","bio":"dev"}')// returns: {name:'alice', email:'a@b.com', bio:'dev'}