Mass Assignment
High · Access Control · CWE-915
Description
Client sets privileged fields (role, isAdmin) via JSON/form.
Root cause
Binding request body directly to models.
Impact
Privilege escalation.
Detection
Extra field probing.
Mitigation
Allow-list bindable fields; never bind role flags from client.
Secure coding
DTOs with explicit fields.
Safe lab example
API security labs
Practise related skills in Labs or deepen on Academy library.