A municipal API accepts a hidden role field from the client JSON body and grants admin features when it is set. What flaw theme should the tester call out?
Select an answer to reveal the explanation.
Short Explanation
If the name tag on the badge comes from the visitor's pocket, anyone can write Admin. Client-supplied roles and privileged fields are not evidence of authority. The server must decide roles from its own session and datastore.
Full Explanation
Applications must not trust client-provided role, isAdmin, or similar privileged fields for authorization decisions. This pattern overlaps mass assignment and broken access control: attackers elevate by editing request bodies. Bind roles from authenticated server-side identity and allowlist writable fields. Cosmetic or caching issues are unrelated distractors.