Joshua Sedler
--- a/src/Resource/CartAddResource.php
+++ b/src/Resource/CartAddResource.php
+        // Calculate invalid fields by checking, whether the provided meta
+        // fields actually exist on the order item entity:
+        $invalid_fields = array_diff_key($meta, $field_definitions);
+        // "combine" and "arity" are special meta properties that are not field
+        // definitions.
+        // Remove them from the list of invalid fields:
+        unset($invalid_fields['combine'], $invalid_fields['arity']);
+        if (!empty($invalid_fields)) {
+          $fields_string = implode(', ', array_keys($invalid_fields));
+          throw new UnprocessableEntityHttpException(strip_tags("The given meta fields '$fields_string' are not valid entity fields."));
+        }
+
+        // Check meta for any base fields. We shouldn't allow to modify these:
+        $matched_field_definitions = array_intersect_key($field_definitions, $meta);
+        foreach ($matched_field_definitions as $field_definition) {
+          if ($field_definition instanceof BaseFieldDefinition && $field_definition->getName() !== 'quantity') {
--- a/src/Resource/CartAddResource.php
+++ b/src/Resource/CartAddResource.php
        // @todo https://www.drupal.org/project/commerce/issues/3101651
        $cart = $this->getCartForOrderItem($order_item, $store);
        $order_item->set('order_id', $cart);
-        static::validate($order_item, ['quantity', 'purchased_entity']);
+
+        // Get order item field definitions:
+        $field_definitions = $order_item->getFieldDefinitions();
+
+        // Calculate invalid fields by checking, whether the provided meta