thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Mass Assignment

A vulnerability where a framework binds all request parameters to object properties, letting users set fields they should not control.

Definition

Also called autobinding or object injection in some frameworks, mass assignment lets attackers set properties like role, balance or verified. Mitigations include allowlisting bindable fields, using data transfer objects and marking sensitive fields read-only. Tracked as CWE-915.

Example

Adding "role":"admin" to a profile update JSON body promotes the user.

Exam tip

Fix with allowlists/DTOs; tested as part of API3:2023 BOPLA.

Related terms