Mass assignment / auto-binding privilege escalation. Load when an API binds JSON directly to a model (Rails, Spring, Django REST, Node/Mongoose), on signup/profile-update/create endpoints, or when responses expose fields you didn't send (role, isAdmin, balance, verified). Signals: ORM object binding, extra fields accepted silently.
