first of all, sorry for my bad English :)

Let say I have a model and controller for my REST API,

PostModel.js:

const postSchema = new mongoose.Schema({
    author: {
        type: mongoose.Types.ObjectId, 
        required: true
    },
    title: String,
    content: String
})

postController.js:

const createPost = async (req, res, next) => {
   const newPost = await Post.create(req.body);

   res.status(200).json bla bla bla
}

is data from req.body can be (edit / attack / inject) by the client?

I imagine like this:

1. from frontend, form only have title and description fields
2. user fill the title and description
3. and user force attack/injects the author id to another user id

Thanks <3