Mass Assignment

Offensive Security

The ID Was in the Body: CVE-2026-47849 and JSON Patch
Bypog0 September 1, 2026August 31, 2026

CVE-2026-47849 let JSON Patch mutate Spring Data REST identifiers and version fields. This analysis verifies the binding flaw, traces the cross-record overwrite path, and maps practical detection and hardening controls.

Read More The ID Was in the Body: CVE-2026-47849 and JSON Patch
Offensive Security | Tools & Labs

Burp Suite Extensions for API Security
Bypog0 June 1, 2026June 22, 2026

An AppSec guide to building safe Burp Suite extensions for authorized API assessments across JWT, BOLA/IDOR, mass assignment, rate limiting, OpenAPI drift, and evidence collection.

Read More Burp Suite Extensions for API Security