Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Remediation
References
https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
Related Vulnerabilities
CVE-2022-25854 Vulnerability in npm package @yaireo/tagify
CVE-2013-4366 Vulnerability in maven package org.apache.httpcomponents:httpclient
CVE-2022-45598 Vulnerability in npm package @joplin/renderer
CVE-2022-2564 Vulnerability in maven package org.webjars.npm:mongoose
CVE-2018-5673 Vulnerability in maven package org.webjars.bowergithub.dojo:dojo