Role Assignment Restricted

A user update endpoint that accepts a role or isAdmin field in the request body without admin verification is a mass assignment vulnerability (CWE-915) enabling privilege escalation (CWE-285). Any authenticated user who POSTs { "role": "admin" } to their own profile endpoint will elevate their privileges if the backend spreads the request body directly into a database update. OWASP A01 (Broken Access Control) flags this pattern explicitly. NIST 800-53 AC-6 (Least Privilege) requires that users cannot grant themselves permissions beyond what they were assigned.

Define a profile update Zod schema that does not include role, permissions, or any privilege field. Handle role changes through a separate admin-only endpoint.

// lib/schemas/user.ts
export const UserProfileUpdateSchema = z.object({
  displayName: z.string().optional(),
  bio: z.string().optional(),
  // 'role' is intentionally absent
});

// app/api/admin/users/[id]/role/route.ts — separate admin-only endpoint
export async function PATCH(req: NextRequest, { params }) {
  const session = await auth();
  if (session?.user.role !== 'admin') return NextResponse.json({}, { status: 403 });
  const { role } = await req.json();
  await db.user.update({ where: { id: params.id }, data: { role } });
}

UserProfileUpdateSchema.parse() silently drops any fields not in the schema, so attackers cannot inject privilege fields even if they try.