Vulnerable code sample

# In a file like aplication/serializers.py
# Note: This code is a representation of the described vulnerability.

from django.contrib.auth.models import User
from rest_framework import serializers

class CustomUserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = [
            'id',
            'username',
            'first_name',
            'last_name',
            'email',
            'is_staff',
            'is_active',
            'is_superuser',  # The vulnerable field
            'last_login',
            'date_joined'
        ]
        # The 'is_superuser' field is critically missing from read_only_fields,
        # making it writable through the API.
        read_only_fields = [
            'last_login',
            'date_joined'
        ]


# In a file like application/views.py
# Note: This code is a representation of the described vulnerability.

from django.contrib.auth.models import User
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status
from rest_framework.permissions import IsAuthenticated
# from .serializers import CustomUserSerializer # Assumed import

class EditUserView(APIView):
    """
    Allows editing a user's details.
    Vulnerable because it uses CustomUserSerializer without any further
    validation on who can modify sensitive fields like 'is_superuser'.
    """
    permission_classes = [IsAuthenticated] # Any authenticated user can access this.

    def post(self, request, pk):
        try:
            user = User.objects.get(pk=pk)
        except User.DoesNotExist:
            return Response(
                {"error": "User not found."},
                status=status.HTTP_404_NOT_FOUND
            )

        # The serializer allows 'is_superuser' to be set from request.data
        serializer = CustomUserSerializer(user, data=request.data, partial=True)

        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_200_OK)
        
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)


# In a file like application/urls.py
# Note: This code is a representation of the described vulnerability.

from django.urls import path
# from .views import EditUserView # Assumed import

urlpatterns = [
    # The vulnerable endpoint
    path('api/auth/edituser/<int:pk>', EditUserView.as_view(), name='edit-user'),
]