Most recent entries from all

cnvd-2020-44896

EUVD-2026-42684

fkie_cve-2020-15126

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

GHSA-236h-rqv8-8q73 — GraphQL: Security breach on Viewer query

Affected: npm: parse-server

### Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.

### Patches This vulnerability has been patched in Parse Server 4.3.0.

### Workarounds No

### References See [commit 78239ac](https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa) for details.

Most recent entries from all

cnvd-2020-44896

EUVD-2026-42684

fkie_cve-2020-15126

GHSA-236h-rqv8-8q73 — GraphQL: Security breach on Viewer query

gsd-2020-15126