Mass Assignment (ARCH7129)

Key php.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Assigning a whole request payload directly to an ORM model (Eloquent mass assignment) lets an attacker set protected fields such as is_admin by sending extra parameters.

Incorrect

<?php
$user = User::create($request->all()); // is_admin=1 can be injected

Correct

<?php
$user = User::create($request->only(['name', 'email', 'password']));

Fix

Assign only explicitly allowed fields (only/$fillable); protect all sensitive attributes with $guarded on the model.