CWE-915: Mass Assignment
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Also known as Improperly Controlled Modification of Dynamically-Determined Object Attributes, AutoBinding, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- ash-project ash obanJob argument injection via :args overrides primary_key and tenant in AshOban5.9 Medium
- broadcom spring cloud commons, spring cloud commons +1 moreSpring Cloud Commons no allow list for writable env actuator endpoint6.6 Medium
- spring data rest, vmware spring data rest +1 moreSpring Data REST allows mutation of identifier and version properties via JSON Patch7.1 High
- spring data rest, vmware spring data rest +1 moreSpring Data REST allows mutation of the version property of immutable aggregates via PUT4.3 Medium
- typo3 extension "events 2"Broken Access Control in extension "Events 2" (events2)7.1 High
- dolibarrDolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset8.6 High
- craftcms cmsAuthenticated RCE via `condition.config` JSON cleanse bypass8.7 High
- elated-themes frappeFrappe: Mass assignment via set_value7.1 High
- freebsdposixshm: system calls can incorrectly free memory of largepage objects8.4 High
- rargames 4gaboards4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment7.6 High
- elastic kibanaImproperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification4.3 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke8.5 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i8.3 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +1 more +3 moreData-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod8.8 High
- chatwootChatwoot: Cross-Account Resource Transfer via `account_id` Parameter6.7 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Improper Input Validation in Scheduled Task Configuration5.3 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config8.7 High
- flowiseai flowiseFlowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API8.8 High
- gitlabImproperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab8.4 High
- heyformHeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set5.8 Medium
- rconfig, rconfig v8 core +1 morerConfig Core < 8.2.8 Privilege Escalation via Users API role field5.3 Medium
- decolua 9router9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade8.7 High
- fasterxml jackson-databindjackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy6.5 Medium
- dan-in-ca sip, sustainable irrigation platform +1 moreSustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters8.8 High
- hoppscotchHoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection7.2 High
- drupal eca: event - condition - action, jurgenhaas eca\ +1 moreECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-0744.2 Medium
- labring fastgptFastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion6.3 Medium
- fossbillingFOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use6.9 Medium
- scribanScriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor9.3 Critical
- craftcms cmsCraft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements7.1 High
- hoppscotchMass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite10.0 Critical
- swaldman c3p0c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties6.3 Medium
- dakku tealium iq tag managementTealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-0648.1 High
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.266.5 Medium
- rocket.chatRocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage8.5 High
- fasterxml jackson-databindjackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3 Medium
- fasterxml jackson-databindjackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields5.3 Medium
- ash-project ashPrivate action arguments can be set by user input in Ash5.9 Medium
- budibaseBudibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override8.2 High
- joaonuno flat-to-nested-jsflat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key7.5 High
- jetbrains hubIn JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430,...9.6 Critical
spomky-labs/otphpPackagistspomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError6.9 Medium- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-0065.9 Medium
- drupal, drupal core +1 moreDrupal core - Critical - PHP object injection - SA-CORE-2026-0055.9 Medium
- drupal plotly.js graphingPlotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-0508.1 High
- drupal flag attendance field, flag attendance field project attendance field +1 moreFlag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-0498.1 High
- drupal formatter fieldFormatter Field - Critical - PHP object injection - SA-CONTRIB-2026-0489.8 Critical
- dfir-iris iris-webIRIS has a Mass Assignment issue4.3 Medium
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge7.0 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`8.7 High
- Show moreLoading…