Skip to content
How it worksFree ToolsVuln DBPricingBlogContactLog in
← Back to Glossary
API Security

Mass Assignment

Binding all request parameters to model attributes without filtering sensitive fields.

Mass assignment (or autobinding) occurs when frameworks automatically bind HTTP request parameters to model attributes. Attackers can set fields like isAdmin or role by including them in the request. Prevent with allowlists or DTOs.

Related Terms

SQL InjectionInsecure Direct Object Reference (IDOR)Broken Object Level Authorization (BOLA)

See if your app is vulnerable

Vezraa checks for related security issues. Scan in 25 seconds.

Mass Assignment — Security Glossary | Vezraa