Broken Object Property Level Authorization
API allows users to read or modify object properties they shouldn't have access to — mass assignment, excessive data exposure, or missing field-level access control.
How It Works
This vulnerability combines two issues: mass assignment (user can set properties like role or isAdmin by including them in the request body) and excessive data exposure (API returns more fields than the client needs, including sensitive internal data). When an API blindly accepts all fields from the request body and saves them to the database, or returns full database objects without filtering, it creates serious security holes.
// Mass assignment — accepts any field
app.put('/api/profile', auth, async (req, res) => {
await User.updateOne(
{ _id: req.user.id },
{ $set: req.body } // Accepts role, isAdmin, etc!
);
});// Whitelist allowed fields
app.put('/api/profile', auth, async (req, res) => {
const { name, email, avatar } = req.body;
await User.updateOne(
{ _id: req.user.id },
{ $set: { name, email, avatar } }
);
});Real-World Example
In 2012, a mass assignment vulnerability in GitHub allowed a user to add their SSH key to any organization's repository by including the organization ID in the request body. The vulnerability was discovered by a security researcher who added his key to the Rails repository.
How to Prevent It
- Never pass req.body directly to database operations
- Whitelist allowed fields for each endpoint
- Use DTOs or Zod schemas to validate and filter input
- Return only necessary fields in API responses
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Broken Object Level Authorization (BOLA)
highAPI endpoints don't verify that the requesting user owns the resource they're accessing — allowing attackers to access other users' data by changing object IDs.
Broken Authentication (API)
highAPI authentication mechanisms are weak or improperly implemented — JWT without proper validation, tokens not in httpOnly cookies, or missing token expiration.
Unrestricted Resource Consumption
mediumAPI endpoints without rate limiting, pagination, or resource limits — allowing attackers to exhaust server resources, rack up costs, or extract large datasets.
Broken Function Level Authorization
highAdmin or privileged API endpoints accessible to regular users — missing role checks allow privilege escalation to administrative functions.