The hotel check-in trick
Imagine you walk up to a hotel front desk, pick up the paper check-in form, and fill it in normally: your name, check-in date, number of guests, room type: Standard. But before you slide it back across the counter, you quietly pencil in one more line — room type: Presidential Suite. The receptionist types every field into the system without a second glance. You just upgraded yourself for free.
That is Mass Assignment. And developers reproduce this exact vulnerability in API code every single day, usually without realising it.
What is Mass Assignment?
Mass Assignment happens when a server takes user-supplied data and binds it directly to an internal model, without filtering which fields the user is actually allowed to set.
