GSSA-2026-04-QZEZQZ2026-04-25
2.7 Low

Settings PATCH allowed wide field assignment (mass-assignment within admin scope)

The settings PATCH endpoint accepted the entire body, only stripping `id` and `createdAt`. Any other Guild model field — including bot identity fields covered by the dedicated customization endpoint — could be set without that endpoint's validation.

The settings PATCH endpoint accepted the entire body and only stripped id and createdAt, so any other Guild field — including bot identity fields covered by the dedicated customization endpoint — could be set without that endpoint's validation.