Vulnerability Description
A vulnerability exists in the user profile update endpoint where arbitrary parameters sent in the request body are processed without validation. Attackers can exploit this Mass Assignment vulnerability by passing administrative flags (e.g., "role": "admin") during a profile update, effectively granting themselves administrative privileges.
Impact
This is a high-severity risk. Unprivileged users can escalate their roles, giving them unauthorized access to administrative functions, including modifying other user accounts, deleting data, and altering application configurations.
Remediation Steps
- Implement strict whitelisting for fields that can be updated by standard users (e.g.,
name, bio, avatar).
- Ignore or explicitly reject restricted fields (like
role, permissions, is_admin) in standard endpoints.
- Require specific, protected endpoints with proper authorization checks for role modifications.
Vulnerability Description
A vulnerability exists in the user profile update endpoint where arbitrary parameters sent in the request body are processed without validation. Attackers can exploit this Mass Assignment vulnerability by passing administrative flags (e.g.,
"role": "admin") during a profile update, effectively granting themselves administrative privileges.Impact
This is a high-severity risk. Unprivileged users can escalate their roles, giving them unauthorized access to administrative functions, including modifying other user accounts, deleting data, and altering application configurations.
Remediation Steps
name,bio,avatar).role,permissions,is_admin) in standard endpoints.