Threats tagged 'ghsa-px4x-x79p-cjfv'

Parse Server versions before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 have a vulnerability where stored field values are returned in object update responses without verifying read access. This allows clients with update permissions but without read permissions to access object data, including atomic operation results and Cloud Code trigger-set values.