CVE-2020-15126

Published: Jul 22, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

Affected (1)

Products: Parseplatform: Parse Server

Parseplatform

1 product

Parse Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Parseplatform Parse Server	From 3.5.0 to 4.3.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430

Source: security-advisories@github.com

Release NotesThird Party Advisory

https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73

Source: security-advisories@github.com

Third Party Advisory

https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.