Mass assignment happens when an API automatically copies every field in a request into an internal object. An attacker adds fields they should not control, such as "role": "admin" or "price": 0, and the API saves them.

How it works

Frameworks make it easy to bind a request body directly to a database model. If the developer does not restrict which fields may be set, any property on the model can be changed through the API, including ones that never appear in the user interface.

Why it matters

• Privilege escalation by setting role or permission fields.
• Price or quantity manipulation in orders.
• Changes to other protected fields such as account status or ownership.

Best practices

• Allow-list the fields each endpoint accepts; never bind whole request bodies to models.
• Use separate input and output data structures (DTOs).
• Validate business rules on the server, such as prices and quantities.
• Test each write endpoint with extra, unexpected fields.

How Vooki Pro helps

• Tests API endpoints for mass assignment and broken object property-level authorization.
• Includes business-logic checks for price and quantity manipulation, coupon abuse and workflow bypass.
• Tests write methods (POST, PUT, PATCH) with a safety guard for state-changing requests.
• Shows the exact request body that triggered the finding.

Frequently asked questions

What is mass assignment?

When an API binds every field in a request to an object, letting attackers set fields they should not control.

How do I prevent mass assignment?

Allow-list accepted fields for each endpoint and use separate input models instead of binding requests to database models.

Related: Shadow APIs and API inventory: find what you forgot · GraphQL security testing