Mass Assignment
Unsafe Model Binding
0 / 4 solved
Modify fields the frontend never intended users to control and see whether the backend binds them anyway.
Quick reference
Mass assignment cheat sheet
Capture a legitimate object update, then test whether the server accepts properties that the normal UI never lets the user change.
Where to look
- Profile update APIs, account settings, user/admin models, billing/workspace settings, registration endpoints, and JSON PATCH/PUT requests.
- Compare properties returned by GET responses with the smaller set submitted by the frontend.
- Look for server-controlled fields such as role, isAdmin, verified, balance, credit, plan, ownerId, status, permissions, or tenantId.
Simple checks
- Keep the valid request intact and add exactly one unexpected property.
- Observe whether the server ignores it, rejects it, or persists it.
- Repeat with a second account/object when ownership-related fields are involved.
{"displayName":"Maya","role":"admin"}company=Acme&phone=5550100&storeCredit=5000Realistic tips
- Do not blindly add hundreds of fields. Infer likely model properties from responses, client code, API docs, and naming conventions.
- The secure pattern is an explicit allowlist/request DTO plus authorization for sensitive state transitions.
- Mass assignment can create privilege escalation, business-logic abuse, or cross-tenant ownership changes depending on the field.