Mass Assignment
Mass assignment occurs when an API automatically binds client-provided data to internal object properties without proper filtering. Attackers can set fields they should not have access to, such as admin roles, pricing, or permissions.
Overview
Mass assignment (also known as auto-binding or object injection) exploits APIs that automatically map client-provided data to internal data models without filtering. Modern frameworks often provide convenient data binding features, but without explicit control over which fields are bindable, attackers can set sensitive properties like isAdmin, price, or role.
Impact
Privilege escalation, data manipulation, bypassing business logic, unauthorized field modification.
Examples
Role Escalation
POST /api/users/register
{"email":"user@test.com","password":"pass123","role":"admin"}Remediation
Use allowlists for bindable fields, implement DTOs/view models, never bind user input directly to database models, and validate all input against the expected schema.
Define explicit allowlists of bindable properties
Use DTOs (Data Transfer Objects) to control input shapes
Never bind user input directly to ORM models
Document and enforce expected request schemas
Related SuperClue scanner checks
These scanner checks look for signs of Mass Assignment. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works