CWE-915: Mass Assignment
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Also known as Improperly Controlled Modification of Dynamically-Determined Object Attributes, AutoBinding, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- aptrsAPTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint9.4 Critical
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Prototype Pollution via parse()8.9 High
- collerek ormarormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor7.1 High
- kanboardKanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin7.0 High
- parse-community parse-serverParse Server session creation endpoint allows overwriting server-generated session fields4.3 Medium
- citeum openctiOpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities6.5 Medium
- danthedeckie simpleeval, red hat openshift ai (rhoai), openshift ai 2.25 +1 more +3 more(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.8.7 High
- wintercms winterWinter: Privilege escalation by authenticated backend users10.0 Critical
- django-commons django-unicorn, django-unicorn unicorn +1 moredjango-unicorn affected by component state manipulation via unvalidated attribute access5.3 Medium
- flowiseai flowiseFlowise: Mass Assignment in `/api/v1/leads` Endpoint7.7 High
- grokability, inc. snipe-itSnipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation8.7 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable8.7 High
- craftcms cms, craft cms +1 moreCraft Affected by Entries Authorship Spoofing via Mass Assignment7.1 High
- discoursePrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners1.3 Low
- svelteSvelte SSR attribute spreading includes inherited properties from prototype chain5.3 Medium
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus is vulnerable to Prototype Pollution9.4 Critical
- franklioxygen mytubeMyTube has Mass Assignment via Settings Management2.7 Low
- lobehub lobe-chatLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion3.7 Low
- made i.t. formsUmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation7.5 High
- adonisjs lucidMass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State8.2 High
- dfir-iris iris, iris-web +1 moreIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management9.6 Critical
- kromit titraTitra API Contains Mass Assignment Vulnerability4.3 Medium
- citeum openctiGraphQL IDOR allows authenticated user to delete workspace content of other users7.1 High
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to RCE with database restore functionality9.1 Critical
- danny-avila librechatLibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission Changes5.3 Medium
- moxa mxsecurity seriesUnauthenticated Device Registration Vulnerability in MXsecurity Series6.3 Medium
- syntax-tree mdast-util-to-hastmdast-util-to-hast unsanitized class attribute6.9 Medium
maxminddbcrates.iomaxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe1.0 Low- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2025-0065.9 Medium
pdfminerDebian,pdfminer-sixPyPI,python-pdfminer.sixopenEuler +2 moreInsecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc6.5 Medium- hcl myxalytics, hcltech dryice myxalytics +1 moreHCL MyXalytics product is affected by Mass Assignment vulnerability7.6 High
- danny-avila danny-avila/librechat, librechat +1 moreMass Assignment in danny-avila/librechat4.3 Medium
- seperman deepdiffDeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution10.0 Critical
- No product listedAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, proto, and Object.assign components. NOTE: this is disputed by the Supplier who do…5.7 Medium
- comfyanonymous comfyuicomfyanonymous comfyui utils.py set_attr dynamically-determined object attributes2.3 Low
- handcraftedinthealps goodby-csvhandcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution3.9 Low
- mesop-dev mesopMesop Class Pollution vulnerability leads to DoS and Jailbreak attacks8.1 High
- danny-avila danny-avila/librechat, librechat +1 moreMass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechat4.6 Medium
- owen2345 camaleon-cmsCamaleon CMS Privilege Escalation9.4 Critical
- adamghill django-unicornDjango-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass9.3 Critical
- apache strutsApache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks9.5 Critical
- lightning-ai lightning-ai/pytorch-lightning, lightning ai ai\/pytorch lightning, lightningai pytorch lightning +2 moreRCE via Property/Class Pollution in lightning-ai/pytorch-lightning9.8 Critical
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anything-llm, anythingllm +2 moreMass Assignment Vulnerability in mintplex-labs/anything-llm9.1 Critical
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 morePrivilege Escalation via Mass Assignment in mintplex-labs/anything-llm7.2 High
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget Chain - SA-CORE-2026-0026.6 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget Chain - SA-CORE-2025-0037.5 High
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-0089.8 Critical
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-0079.8 Critical
- drupal, drupal core +1 moreDrupal core - Less critical - Gadget chain - SA-CORE-2024-0069.8 Critical
- moxa mxsecurity, mxsecurity series +1 moreMXsecurity Register Database Pollution5.3 Medium
- Show moreLoading…