GraphQL: Security breach on Viewer query

MEDIO 6.5CVE-2020-15126 · GHSA-236h-rqv8-8q73 · Published 22/07/2020 · updated 17/06/2026

En resumen

CVE-2020-15126 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a parse server (parseplatform), parse-server.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.1%, mayor que el 64.9% de las vulnerabilidades.
Solución: actualizar a 4.3.0 o posterior.

Package	Affected versions	Patched versions
parse server parseplatform	`≥ 3.5.0, < 4.3.0`	`4.3.0`
parse-server npm	`≥ 3.5.0, < 4.3.0`	`4.3.0`

Description

Impact

An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.

Patches

This vulnerability has been patched in Parse Server 4.3.0.

Workarounds

References

See commit 78239ac for details.

NVD description

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

References

parse-community/parse-server security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-15126 · ADVISORY
parse-community/parse-server commit 78239ac · WEB
parse-community/parse-server · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free