Frameworks and ORMs make it convenient to take the request body and save it in one line. That convenience is the problem: if the user adds an extra field to the JSON, such as role set to admin or plan set to enterprise, the code saves it along with the legitimate ones.
This is very common in AI-generated CRUD code, where an update endpoint looks like a single call that passes the whole body to the database. The screen only shows name and email fields, so it looks safe, but attackers do not use your screen. They send the request directly with extra properties.
Fix it by deciding which fields each endpoint may accept and ignoring everything else. Use an explicit allowlist, or define a separate input type that lists only the editable fields, and validate it with a schema. Never accept ownership, role, price, or status fields from the client on create or update. Set those on the server based on the logged-in user and business rules.
const { name, email } = schema.parse(req.body);
await db.user.update({ where: { id: session.user.id }, data: { name, email } });