Cybersecurity glossary
What is Mass Assignment?
Learn what mass assignment is, how APIs bind client fields onto sensitive object properties, real-world privilege escalation examples, and allowlist patterns that stop unauthorized writes.
Definition
Mass assignment is a vulnerability where an application automatically binds client-supplied input to internal object properties without an allowlist—letting attackers modify privileged fields such as roles, prices, or ownership by including unexpected parameters in requests.
Why mass assignment matters
Developer frameworks love convenience: take JSON, hydrate an object, save. Mass assignment is that convenience without a filter—client input becomes internal state, including fields no user should control.
A single extra property in a PATCH body can equal privilege escalation.
How mass assignment happens
Entity binding
Controllers bind request bodies directly onto ORM models.
Open update payloads
Schemas allow additionalProperties or untyped maps.
Shared create/update models
Admin-only fields exist on DTOs reused by user endpoints.
Nested object updates
Deep merges let clients overwrite privileged child attributes.
Typical exploit path
Observe legitimate update traffic
Learn which endpoint updates profiles, orders, or settings.
Identify privileged property names
Infer from docs, JS bundles, excessive responses, or common conventions.
Inject extra fields
Add role, price, or ownership properties to the JSON body.
Submit as a normal user
Authenticate with low privilege and send the crafted update.
Confirm persistence
Re-fetch the object and verify the privileged field changed.
Escalate and automate
Use the new privileges or script the pattern across accounts.
Safe binding patterns
| Pattern | Verdict | Reason |
|---|---|---|
| Bind to ORM entity | Unsafe | Exposes all columns as writable |
| Allowlist DTO fields | Safe | Only intended properties exist |
| Schema additionalProperties:false | Safe aid | Blocks undeclared JSON keys early |
| Denylist a few fields | Fragile | New privileged columns get missed |
Mass assignment prevention checklist
- Use dedicated request DTOs with explicit allowlisted properties.
- Never bind client input directly onto persistence entities.
- Prefer allowlists over denylists for writable fields.
- Reject unknown properties in schema validation for write APIs.
- Authorize sensitive fields server-side even if present in admin DTOs.
- Add regression tests that attempt privileged field injection.
- Review GraphQL input types for accidental privileged arguments.
- Monitor update payloads for unexpected property names.
The practical takeaway
Mass assignment lets clients write properties they were never meant to control. Framework convenience is not an authorization strategy.
Allowlist writable fields, validate schemas strictly, and treat unexpected properties as hostile by default.
Related security terms
Broken Object Property-Level Authorization (BOPLA)
OWASP API category that includes unauthorized property writes.
Schema Validation
Rejects undeclared properties before they reach binders.
Excessive Data Exposure
Read-side oversharing that often accompanies permissive models.
Privilege Escalation
Common outcome when role or entitlement fields are assignable.
API Schema
Contract that should declare only legitimate writable fields.
Frequently asked questions
What is mass assignment in simple terms?
The server copies whatever JSON fields you send onto a database object. If you add isAdmin:true and the binder accepts it, you become an admin.
Is mass assignment only a Rails/ASP.NET issue?
No. Any stack with automatic request-to-object binding can be vulnerable—including Node, Java, PHP, and GraphQL mutation inputs.
How is it different from BOLA?
BOLA is about accessing the wrong object. Mass assignment is about writing the wrong properties on an object you may already access.
What fields are commonly abused?
role, isAdmin, verified, balance, price, accountId, tenantId, and feature flags.
Does using DTOs fix it?
Yes when DTOs expose only safe writable fields. Reusing persistence entities as request bodies often reintroduces the bug.
Can GraphQL mutations be mass-assigned?
If input types include privileged fields and resolvers pass them through unchecked, yes.
How do you test for it?
Add unexpected privileged properties to create/update requests and verify they are ignored or rejected.
References
Explore authoritative guidance and frameworks related to mass assignment.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.