Most recent entries from all

cnvd-2020-44896

2026-10-10T05:00:21.983911+00:00

cnvd-2020-44896

EUVD-2026-42684

2026-10-10T05:00:21.983944+00:00

EUVD-2026-42684

fkie_cve-2020-15126

2026-10-10T05:00:21.983958+00:00

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

GHSA-236h-rqv8-8q73 — GraphQL: Security breach on Viewer query

2026-10-10T05:00:21.983986+00:00

Affected: npm: parse-server

### Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.

### Patches This vulnerability has been patched in Parse Server 4.3.0.

### Workarounds No

### References See [commit 78239ac](https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa) for details.

gsd-2020-15126

2026-10-10T05:00:21.984012+00:00

gsd-2020-15126