Skip to content
AppArch AppArch Docs

Mass Assignment (ARCH7129)

Key php.security.mass-assignment · Severity warning · Category security · CWE CWE-915

Assigning a whole request payload directly to an ORM model (Eloquent mass assignment) lets an attacker set protected fields such as is_admin by sending extra parameters.

Incorrect

Section titled “Incorrect”
<?php
$user = User::create($request->all()); // is_admin=1 can be injected

Correct

Section titled “Correct”
<?php
$user = User::create($request->only(['name', 'email', 'password']));

Fix

Section titled “Fix”

Assign only explicitly allowed fields (only/$fillable); protect all sensitive attributes with $guarded on the model.