Both read and write failures have serious consequences.
👑
Privilege Escalation
An attacker sets isAdmin=true or role=superuser on their own account. Suddenly a regular user has administrator access to the entire platform.
💰
Financial Manipulation
An attacker changes price=0, discount=100, or balance=999999 on a purchase or account. They pay nothing for paid goods, or inflate a wallet balance.
📋
PII Exposure
The API returns a user object containing passwordHash, resetToken, socialSecurityNumber, or dateOfBirth — fields that should never leave the server. Attackers read these from the raw API response.
🔓
Account Takeover via Token Exposure
If the API returns a password reset token or email verification token in the response, an attacker who reads it can trigger a reset and take the account — without ever requesting a reset themselves.
🚫
Content Moderation Bypass
An attacker sets blocked=false, reviewed=false, or approved=true on their content, bypassing moderation queues and publishing content that should have been held.