Binding only what you mean to

Name the fields

The cure is to stop blindly mapping input onto objects:

Tip: Bind only an explicit allow-list of fields (a DTO / strong parameters / schema), and set privileged attributes like role server-side, never from the request. Separate the data a user may set from the data only the system may set, and ignore any extra parameters rather than trusting them.