CVEvulnerability
CVE-2020-15126
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-07-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-863
Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Affected configurations
• parseplatform parse server (>= 3.5.0 < 4.3.0)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430 Release Notes, Third Party Advisory
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa Patch, Third Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 Third Party Advisory
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430 Release Notes, Third Party Advisory
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa Patch, Third Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 Third Party Advisory