many to many attach issue

[winavin]

My Controller

class AssociateController extends ApiRelationController
{
    protected $model = Association::class;
    protected $relation = 'associates';

    protected $request = AssociateRequest::class;
    protected $policy = AssociatePolicy::class;
    protected $parentPolicy = AssociationPolicy::class;
    protected $pivotFillable = [
        'role',
        'membership',
        'first_date_of_membership',
        'last_date_of_membership',
    ];
}

Step 1: Attach multiple instance
POST: http://localhost:8000/api/associations/{association}/associates/attach

{
    "resources" : {
        "navin" : {
            "role" : "Admin",
            "first_date_of_membership" : "2024-6-20"
        },
        "grishma" : {
            "role" : "Associate",
            "first_date_of_membership" : "2024-6-20",
            "last_date_of_membership" : "2025-6-21",
            "membership" : "Monthly"
        }
    }
}

Output: Data entered correctly.

step 2: again fire with partial data

{
    "resources" : {
        "navin" : {
            "role" : "Admin",
            "first_date_of_membership" : "2024-6-20"
        }
    }
}

Output: all pivot rows updated with given data, not just for 'navin'

this will be security issue everyone else will become 'Admin' with this API