Threats tagged 'ghsa-9cq8-mq5q-gphm'

Parse Server versions before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 have an information disclosure vulnerability where object create responses include field values even if the caller lacks read access via class-level permissions or ACL. This allows attackers with create permissions to obtain sensitive values set by Cloud Code triggers, schema defaults, or class default ACLs.