Mass assignment lives in the gap between the form the user sees and the object the server saves. The framework binds your whole request body to the user model. So you add "role":"admin" to a normal profile update, and the server writes it. This gave Egor Homakov commit access to rails/rails on GitHub in 2012. Every write endpoint is a candidate: enumerate what the object holds, not what the UI shows. https://www.kayssel.com/newsletter/issue-64/ #InfoSec #CyberSecurity #Pentesting #BugBounty #OffSec #APISecurity