akinder volunteer testing

The /api/agency/update endpoint allows an authenticated user to modify restricted fields such as status. This enables a user to self-verify or change their account status without admin approval, leading to privilege escalation.

Endpoint:
POST https://devapi.akindervolunteer.com/api/agency/update

Steps to Reproduce:

1. Authenticate as a normal agency user.
2. Send the following request:

POST /api/agency/update
Authorization: Bearer <user_token>
Content-Type: application/json

{
  "status": "Available"
}

3. Observe that the user's status is updated successfully.

Expected Behavior:
Only administrators should be able to update sensitive fields like status.

Actual Behavior:
Any authenticated user can update their own status.