Mass assignment lets a user grant themselves administrative role
- Affected asset
- PATCH /api/v1/users/self on api.example.com.au
- Rating
- Extreme Likely 4 × Severe 5 = 20
Description
The profile update endpoint binds the whole request body to the user object without a field allow-list. By adding a role field to an otherwise ordinary update, a standard user can set their own account to administrator.
Evidence
PATCH /api/v1/users/self HTTP/1.1
Host: api.example.com.au
Authorization: Bearer eyJhbGciOi... # a standard user's token
Content-Type: application/json
{ "displayName":"Jo Tan", "role":"admin" }
HTTP/1.1 200 OK
{ "id":8831, "displayName":"Jo Tan", "role":"admin" }
A standard user updated their display name and, in the same request, escalated their own role to administrator.
Impact
Any registered user can become an administrator with a single request, then read and change every other account and record. Mass assignment is invisible to a scanner because the request is valid; only a consultant testing each field against the data model finds it.
Remediation
Bind requests to an explicit allow-list of fields the client is permitted to set, and never to the full object. Set privileged fields such as role only through a separate, authorised administrative flow, and reject unexpected fields rather than ignoring them silently.