Threats tagged 'ghsa-w9vv-f4q5-5fgr'

Parse Server versions before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 have a vulnerability where the stored value of a field reverted by a beforeSave trigger is returned in object update responses. This occurs even if the client lacks read access to that object or field. An authenticated client who can update an object with such a beforeSave trigger can read protected values, including raw MFA authData when protectedFieldsTriggerExempt is enabled.