Skip to content

Cybersecurity Atlasby Jer Catallo

Cybersecurity Atlas

One reference surface for application, cloud and product security.

API documentation

Find & Respond

AppSec Playbook
Vulnerabilities Atlas

Build & Harden

Hardening Atlas
Security Tooling

Learn the Fundamentals

Security Concepts

Resources

OWASP Top 10
MITRE ATT&CK
NIST Cybersecurity Framework

© 2026 Jer Catallo. Reference material only, always confirm against the official source.

About
API Documentation

Mass Assignment incident response playbook · Cybersecurity Atlas

Home
Playbook
Mass Assignment

Mass Assignment

HighAPI SecurityAPI3:2023 – Broken Object Property Level Authorization

An API binds client-supplied fields directly to internal objects, letting attackers set properties they should not control, such as role, isAdmin, balance, or ownerId.

Immediate Response

1Revert unauthorized changes to roles, balances, or ownership.
2Block the affected endpoint or strip sensitive fields at the gateway.
3Audit logs to find all accounts that exploited the flaw.
4Invalidate sessions for accounts that self-escalated privileges.

Short-term Remediation

1Bind requests to explicit DTOs or allowlists of writable fields.
2Reject requests with unknown properties using strict schema validation.
3Mark sensitive model attributes as read-only or guarded in the ORM.
4Add authorization checks for any field that changes privileges or ownership.

Long-term Prevention

1Generate validation from an OpenAPI schema with additionalProperties set to false.
2Add mass assignment test cases to API security tests.
3Review new endpoints for direct model binding in code review.
4Document writable fields per role in API specifications.

Attack vectors

Extra JSON properties in create or update requests
Frameworks that auto-bind request bodies to ORM models
Nested objects that update related records
Undocumented fields discovered from API responses or client code

Indicators of compromise

Privilege or role changes not made through admin workflows
Requests containing fields not present in the API schema
Records whose owner or tenant changed unexpectedly
Spikes in validation errors after schema enforcement is added

Tooling

Burp SuitePostmanArjunSemgrep

References

cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html
owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/