#vulns.co
/
mcp by GKData.io

← Back to Gadgets

Mass assignment / extra JSON field

Frameworks that bind the whole JSON body onto a model. Hidden fields in Rails/Laravel, extra keys in Node/Express, GraphQL arguments that exist in the schema but not the UI.

Tags: mass-assignment, priv-esc, api

Typical severity: P2-P3

What it becomes

role, isAdmin, verified, balance, price, tenantId, twoFactorEnabled in a request the client never sends.

Where to look

  • PATCH /me
  • register
  • update profile
  • GraphQL updateUser
  • CSV import columns

Chains

  • Priv-esc — isAdmin true or role=admin on your own object.
  • ATO — email verified true, or set someone else's email then reset.

Notes

  • Diff the OPTIONS/schema against the UI. Anything in the schema is a param.
  • Also try HTTP parameter pollution and JSON overrides of form fields (method override).

← Back to Gadgets