Users were able to submit changes to fields they should not have access to change by bypassing the frontend validation. Correct backend validation to prevent that.