The framework auto-maps incoming JSON to model DB fields.
**Category:** [Web ยท OWASP Top 10](/en/glossary) ๐ฏ **Trench** โ The framework auto-maps incoming JSON to model DB fields. If the developer doesn't declare which fields are **fillable**, you pass `{"role": "admin"}` and you escalate privileges. ๐ **Kill chain** โ Prerequisite: create or update endpoint. Next: vertical escalation (`is_admin`, `role`, `tenant_id`), business validation bypass. ๐ก **Defensive footprint** โ Field changes not exposed in the UI form. Hard to detect after the fact without per-column auditing. โ ๏ธ **False friend** โ Assuming it's only a Rails issue. Laravel, Django, Spring Boot, Express + Mongoose โ all have the same pattern when used incorrectly. ๐ก๏ธ **Remediation** โ Explicit field whitelist. ```php theme={null} // VULNERABLE $user->update($request->all()); // SAFE $user->update($request->only(['name', 'email'])); // or in the model: protected $fillable = ['name', 'email']; ``` *** โ [Back to the full glossary](/en/glossary) *Last updated: 2026-06-11*