It seems like a rather... fundamental bug? As in, a "not doing any validation, just passing the API request straight to the DB" bug?