[CRITICAL] Privilege Escalation: Standard user can elevate role to Administrator

[codebyfernanda]

Description

A security vulnerability has been identified in the PUT /usuarios/{id} endpoint, allowing an authenticated standard user to alter their own access privileges and become an administrator (administrador: true).

Steps to Reproduce

1. Register a new standard user (administrador: false) via POST /usuarios.
2. Log in with this user via POST /login to obtain the access token.
3. Send a PUT request to https://compassuol.serverest.dev/usuarios/{id_do_usuario} using the obtained token.
4. Include the following JSON payload in the request body, setting the administrator field to true:

{
  "nome": "[Registered Name]",
  "email": "[Registered Email]@qa.com.br",
  "password": "[Password]",
  "administrador": "true"
}

Verify the user status by sending a GET /usuarios/{id_do_usuario} request.

Expected Behavior

The system must block or reject changes to the administrador field by standard users, returning a 403 Forbidden status code or simply ignoring the field, ensuring that non-admin users cannot elevate their own privileges.

Actual Behavior

The API returns a 200 OK status code and successfully updates the user's privilege in the database to administrador: true, granting unrestricted access to administrator-only functionalities.

Evidence