Medium severity6.5NVD Advisory· Published Jul 22, 2020· Updated Jun 17, 2026
CVE-2020-15126
CVE-2020-15126
Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
parse-servernpm | >= 3.5.0, < 4.3.0 | 4.3.0 |
Affected products
3- Range: >= 3.5.0, < 4.3.0
Patches
Vulnerability mechanics
References
5- github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aanvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-236h-rqv8-8q73ghsaADVISORY
- github.com/parse-community/parse-server/blob/master/CHANGELOG.mdnvdRelease NotesThird Party AdvisoryWEB
- github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-15126ghsaADVISORY
News mentions
0No linked articles in our index yet.