Mass Assignment occurs when untrusted input is automatically bound or deserialised into program objects without properly restricting which fields can be set. An adversary can exploit this by supplying unexpected parameters to modify sensitive fields (e.g., isAdmin, role, balance) or manipulate database records directly. Many language frameworks provide permissive default behaviour where all object properties are writable unless explicitly protected.

Remediation

• Never expose domain models directly to external endpoints.
• Use dedicated Data Transfer Objects (DTOs) or whitelists to explicitly define which fields can be updated.
• Mark sensitive properties (e.g., user roles, permissions, account balances) as immutable or read-only in your domain models.
• Use framework-specific security features such as parameter whitelisting (strong_parameters in Rails, BindNever in .NET) to prevent unintended binding.
• Perform strict input validation on all incoming fields to prevent injection of unexpected attributes.