Mass assignment
Mass assignment is an API flaw in which a framework binds the fields of an incoming request straight onto an internal object, so a caller can set properties the interface never offered. Adding a field such as role or isAdmin to an otherwise legitimate profile update is the whole attack.
The convenience that causes it is the point of the feature: the framework takes a JSON body and populates a model without the developer listing the fields. The model, however, usually carries more properties than the form does. Anything writable that the binder can see becomes an input, and property level authorisation is the control that was never written.
Finding it is a matter of learning the object’s full shape and then trying to write to it. The shape leaks from the API’s own responses, from an OpenAPI document, from a mobile client, or from a sibling endpoint that returns more fields than it accepts. We take fields that appear in a read response and send them back in a write request, then verify the change from a second account rather than trusting the response body, because plenty of APIs echo an accepted value they did not actually persist.
The fix is an explicit allow list of writable fields per operation, not a deny list of dangerous ones, since a deny list ages badly every time a developer adds a column. The flaw is catalogued together with excessive data exposure as API3:2023, and it is a routine part of the API testing work where we map every object property.