You can actually accomplish something similar to this on an app that isn't using attr_accessible (will probably work if they are using attr_protected). From the

You can actually accomplish something similar to this on an app that isn't using attr_accessible (will probably work if they are using attr_protected). From the Rails docs for has_many: collection_singular_ids=ids Replace the collection with the objects identified by the primary keys in ids The full attack is still tricky. But if there are roles for users you can send role_ids => [1] to become an admin.