Steps to reproduce:

1. Create incorrect API call to host.massupdate method

   {
     "hosts":["10337"]
   }
   

   Notice, only string is given, not object

Observe 1:
Missleading API response:

  "error": {
    "code": -32500,
    "message": "Application error.",
    "data": "You do not have permission to perform this operation."
  },

And runtime error in log file.

PHP Warning:  Illegal string offset 'hostid' in /var/www/html/feature/ZBXNEXT-2156-5.1/ui/include/classes/api/services/CHost.php on line 976"

Also, try such API request:

{
  "hosts":["text"]
}

Then observe more errors in log file - few of them relates to failed DB query

Expected:

1. Correct error message.
2. No runtime errors.

Only tested in 5.2.0alpha1 please check earlier versions.