Mass assignment vulnerability

Error Message

MassAssignmentException: Add [name] to fillable property

Cause

Attempting to create or update a model with fields not listed in the $fillable property. Laravel prevents mass assignment of unprotected fields for security.

Solution

Add the field to the $fillable array in the model, or use the forceCreate/forceUpdate methods (not recommended). Ensure you only make fields fillable that should be user-input.

Code Example

Fix

<?php

class User extends Model
{
    // Whitelist fields that can be mass-assigned
    protected $fillable = [
        'name',
        'email',
        'password',
    ];
}

// Safe: only fillable fields are set
User::create([
    'name' => 'John',
    'email' => 'john@example.com',
    'password' => 'secret',
    'role' => 'admin', // Ignored - not in $fillable
]);

Debugging Steps

Check the model's $fillable array
Verify the field name matches the database column
Review if the field should actually be user-input
Check $guarded array if using guard instead of fill

Prevention

Only add user-input fields to $fillable. Never make role, is_admin, or other privilege fields fillable. Use Form Requests to whitelist input.