Naked - Mass assignment

Your profile

Name: You Learner
Phone: +1-555-0002
Role: user

The update endpoint /m02-p/naked/mass-assign/api/profile binds the whole JSON body onto your record with no allow-list. The visible form only sends name/phone - but the server honours any field you add. Think about what a privileged field is called (hint: role / is_admin), then send it with curl or Burp.