CWE-915: Mass Assignment
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Also known as Improperly Controlled Modification of Dynamically-Determined Object Attributes, AutoBinding, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja before 2.7.1 Mass Assignment via Team external_id Field 5.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.6 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- sensiolabs symfony Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects 6.9 Medium
- craftcms cms Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass 8.7 High
- jetbrains hub In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email... 9.6 Critical
- suitecrm SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only) 7.1 High
- doramart doracms DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint 8.6 High
- plausible analytics, plausible.io plausible analytics +1 more Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update 5.3 Medium
- progress software ws ftp server Privilege Escalation via Missing Authorization in WS_FTP Manager 9.1 Critical
- a2ui-project a2ui a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes 5.1 Medium
- jhuckaby cronicle Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401 8.8 High
- maccmspro maccms10 MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment 6.9 Medium
- gitroomhq postiz-app Forged signed tokens let any registered user take over other users and organizations 9.9 Critical
- drupal monster menus Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 8.8 High
- typo3 extension "typo3 ai integration extension" Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai) 7.2 High
- semaphoreui semaphore ui Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override 8.7 High
- sunkaifei flycms FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update 5.3 Medium
- guangzhou juan iot technology co., ltd. eseecloud app, eseecloud firmware +1 more Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes 6.9 Medium
- devolutions server Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions... 4.3 Medium
- lycheeorg lychee Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request 8.3 High
- code-projects online reviewer system code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes 5.3 Medium
- apache software foundation allura Apache Allura: REST API Mass Assignment 9.1 Critical
- jishenghua jsherp jshERP through 3.6 Mass Assignment via PUT /user/update 8.7 High
- arp242 goatcounter GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment 7.2 High
- drupal block ajax Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 9.8 Critical
- mozilla node-convict CVE-2026-106550 7.5 High
- payloadcms payload Payload: Field-level write access bypass in Payload on MongoDB 7.1 High
- payloadcms payload Payload authentication token field handling issue 9.2 Critical
- techfry tf content, joomlafry.com tf content for joomla +1 more Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 6.9 Medium
- No product listed Jeebase UserService info updateUser dynamically-determined object attributes 5.3 Medium
- middleapi orpc @orpc/zod: Prototype injection in smart coercion 6.5 Medium
- middleapi orpc @orpc/json-schema: Prototype injection in smart coercion 6.5 Medium
- misp MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging 7.1 High
- grafana enterprise, oss +1 more Editor can forge file-provisioning provenance on dashboards via the dashboard API 5.4 Medium
- misp MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events 8.7 High
- bludit cms Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit() 5.3 Medium
- ash-project ash Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash 5.9 Medium
- verbb formie Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials 8.5 High
- drupal commerce decoupled checkout Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179 4.3 Medium
- thomaspoignant scim-patch scim-patch: Mutation of Inherited Built-in Method Objects 4.3 Medium
- nv cssom CSSOM through 0.5.0 Denial of Service via length Property 8.7 High
- djust-org djust djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) 8.1 High
- djust-org djust Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler 7.1 High
- a2ui-project a2ui a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes 5.3 Medium
- spip SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection 9.3 Critical
- eleveo quality management Eleveo Quality Management Conversation events dynamically-determined object attributes 5.3 Medium
- jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their... 8.8 High
- No product listed gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes 5.3 Medium
- fasterxml jackson-databind jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types 5.6 Medium
- Show olderLoading…