  REST APIs have a pivotal role in accessing protected resources. Despite the
availability of security testing tools, mass assignment vulnerabilities are
common in REST APIs, leading to unauthorized manipulation of sensitive data. We
propose a lightweight approach to mine the REST API specifications and identify
operations and attributes that are prone to mass assignment. We conducted a
preliminary study on 100 APIs and found 25 prone to this vulnerability. We
confirmed nine real vulnerable operations in six APIs.
