How do you call REST API resource unintentional field modifying?

Question

Today I stumbled on a potential vulnerability where I could change my profile rank. I'm pretty sure that should not be allowed for regular users.

Let's say, for example; I got an account profile endpoint:

https://example.com/api/account/profile/

For the HTTP GET request, the response looks something like this:

{
    firstName: 'foo',
    lastName: 'bar',
    rank: 1
}

Now I have an account settings page with a profile form where I can change my first & last name.

The updating request was using the HTTP PATCH method, and the body looks like this:

{
    firstName: 'foo2',
    lastName: 'bar2'
}

I tried to change the PATCH body to this:

{
    firstName: 'foo2',
    lastName: 'bar2',
    rank: 5
}

And it changed my rank too.

Now the GET request returns me this:

{
    firstName: 'foo',
    lastName: 'bar',
    rank: 5
}

I'm pretty sure I shouldn't be allowed to change my rank like this for that application.

My question is, is this a vulnerability after all, and if it is, what kind of or how do you call it?

Answer 1

I discovered that the correct vulnerability name is a Mass Assignment in the OWASP API Security Project.