Information disclosure through Viewer query in parse-server
Priority LOW 31CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Why it matters now
EPSS 0.01072 65th percentileScored 2026-11-07
Fix Fixed parse-server (parse-community): 4.3.0parse-server (npm): 4.3.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| parse-community | parse-server | 3.5.0 to before 4.3.0 | 4.3.0 | Patch available | CNA |
| — | parse-server (npm) | 3.5.0 to before 4.3.0 | 4.3.0 | Patch available | GHSA-236h-rqv8-8q73 |
- parse-server Vendorparse-community Affected 3.5.0 to before 4.3.0 Fixed in 4.3.0 Patch available CNA
- parse-server (npm) Vendor— Affected 3.5.0 to before 4.3.0 Fixed in 4.3.0 Patch available GHSA-236h-rqv8-8q73
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:parseplatform:parse_server:*:*:*:*:*:*:*:* | 3.5.0 to before 4.3.0 | Vulnerable | parse-community |
- cpe:2.3:a:parseplatform:parse_server:*:*:*:*:*:*:*:* Versions 3.5.0 to before 4.3.0 Vulnerable ·parse-community
Remediation
- Fix · CNA parse-server (parse-community) Fixed in 4.3.0
- Fix · GHSA-236h-rqv8-8q73 parse-server (npm) Fixed in 4.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15126
- 2026-10-03 Alias added: GHSA-236h-rqv8-8q73
References
Patch 1
Sources
- CVE-2020-15126 · CVE Program
- CVE-2020-15126 · NVD
- FIRST EPSS
- GHSA-236h-rqv8-8q73 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences