Scenario 20: A penetration test shows that submitting {"role":"ADMIN"} in the registration JSON body silently grants the new account admin privileges.

This is a mass-assignment vulnerability caused by binding the incoming @RequestBody directly onto a JPA entity that includes a settable 'role' field — the attacker simply supplies extra fields the endpoint should never have honored. Fix by binding requests to a dedicated DTO containing only the fields a user should legitimately set (never 'role'), and setting sensitive fields like role/isAdmin explicitly and deliberately in server-side code.