Mass assignment vulnerability

Mass assignment is a computer vulnerability where an active record pattern in a web application is abused to modify data items that the user should not normally be allowed to access such as password, granted permissions, or administrator status.

Many web application frameworks offer an active record and object-relational mapping features, where external data in serialization formats is automatically converted on input into internal objects and, in turn, into database record fields. If the framework's interface for that conversion is too permissive and application designer doesn't mark specific fields as immutable, it's possible to overwrite fields that were never intended to be modified from outside (e.g. admin permissions flag).