Your API accepts a JSON object and maps it to a model. That convenience is also how users become admins, balances change, and tenants leak into each other.

Mass assignment is one of those vulnerabilities that feels too simple to be real. The API takes a request body, binds it to an internal object, and saves it. The client sends an extra field. The field is in the model. The server writes it.

That is the whole attack.

It sits at the intersection of two OWASP API risks: API3 (Broken Object Property Level Authorization) and API6 (Unrestricted Access to Sensitive Business Flows) . It is also one of the easiest high-impact bugs to find and one of the easiest to prevent — if you stop treating the database model as the API contract.

A minimal example

PATCH / api / users / me Content - Type : application / json

{ "display_name" : "Alice" , "role" : "admin" , "is_verified" : true , "tenant_id" : "acme-corp" }

Enter fullscreen mode

Exit fullscreen mode

A naive handler:

@app .…