A short-term rental marketplace lets property hosts approve booking requests from guests. When a host approves a booking, their app sends a PUT request to confirm the stay.
The request body is supposed to contain: {"status": "approved"}. But the endpoint accepts and writes all fields it receives.
"total_stay_price": "$10,000" to the body. The API accepts the extra field and writes it to the booking record. The guest's confirmed price is now $10,000 — whatever the host chose to set. The guest has no way to know this happened at the API level.When checkout runs, it reads total_stay_price from the booking record — which now contains the host-modified value. The guest is charged an amount they never agreed to.
The marketplace may not catch this without monitoring for anomalous price values in the booking API, because the approval request itself looks structurally valid.
total_stay_price field that hosts should never be able to set directly — prices are calculated by the platform. But the API accepted the field because nothing restricted what could be written.