ormar, an async mini ORM for Python, has a Pydantic validation bypass issue in its model constructor. This allows unauthenticated users to skip all field validation by injecting " pk only ": true into a JSON request body. The injection of " pk only ": true allows bypassing type checks, constraints, and other validation rules, leading to the persistence of unvalidated data in the database. A secondary issue involves the " excluded " parameter, which can be used to selectively nullify arbitrary model fields during construction. This affects the recommended FastAPI integration pattern, potentially enabling privilege escalation, data integrity violations, and business logic bypass. The root cause is the direct extraction of " pk only " from user-supplied keyword arguments before validation occurs. The ` pk only ` flag was originally intended for internal optimization but is accessible to external callers. The affected entry points include FastAPI routes using ormar models as request body parameters, as well as direct calls to `Model.objects.create(**user dict)` and `Model(**user dict)`.