Threats tagged 'ghsa-mfg3-66fp-4xc4'

Parse Server versions before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 contain a vulnerability where the owning object reference in $relatedTo relation queries is not properly validated. This allows a client with read access to at least one object of the owning class to bypass owning-object ACL checks by supplying a query operator instead of an object ID, potentially disclosing which readable objects are linked to owning objects it cannot read.