| Package | Affected versions | Patched versions |
|---|---|---|
| parse-server | = 9.8.0≥ 9.0.0, < 9.8.0< 8.6.75 | 9.8.08.6.75 |
| parse-server | ≥ 7.0.0, < 8.6.75≥ 9.0.0, < 9.8.0-alpha.7 | 8.6.759.8.0-alpha.7 |
The GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields.
The GET /sessions/me handler now re-fetches the session with the caller's auth context after validating the session token, ensuring protectedFields and CLP apply consistently with other session endpoints.
None.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free