Mass assignment happens when APIs automatically bind request body fields to domain models without strict field-level controls. Attackers inject hidden or sensitive properties such as role flags, account status, price fields, or ownership attributes. This bypasses intended workflows and can lead to privilege escalation or business logic corruption.
Use explicit allowlists for writable fields in each endpoint and block unknown input properties. Separate external input models from internal persistence models. Add validation for immutable fields and privileged attributes, and include tests that attempt to override restricted properties during create and update operations.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#06api06-2019 Mass Assignment
