Mass Assignment
High · Access Control
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-915
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-915
Definition
Client sets privileged fields (role, isAdmin) via JSON/form.
Root cause
Binding request body directly to models.
Affected components
- Components in the “Access Control” class
- Application / API handlers
- Supporting libraries
Impact
Privilege escalation.
Severity
High
Safe lab reproduction
API security labs
Detection methodology
Extra field probing.
Evidence examples
- Lab reproduction notes: API security labs
- Request/response excerpts (redacted)
- Detection signal: Extra field probing
Remediation
Allow-list bindable fields; never bind role flags from client.
Secure coding examples
DTOs with explicit fields.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.