Problem Statement
According to the OWASP API Security 2023 list, which risk covers property-level authorization problems (e.g., setting isAdmin)?
Explanation
API3:2023 merges earlier categories to stress that servers must check authorization not only at the object level but also for each writable field. Blind model binding without allowlists causes painful leaks and privilege flips.
Code Solution
SolutionRead Only
allowedFields = ['name','email']; user.update(pick(req.body, allowedFields))
