Information disclosure in parse-server

Description

1. you can fetch all the users’ objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken ("_SessionToken":{"$regex":"r:027f"}} and find valid accounts this way.

Using this method, it’s possible to retrieve accounts without interaction from the users.

GET /parse/users/me HTTP/1.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0
• Patched version(s): 4.1.0

References

• GHSA-h4mf-75hf-67w4
• CVE-2020-5251
• CWE-200
• CWE-285
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Invalid file request can crash server - CVE-2022-31089
• Parse Server exposes the data schema via GraphQL API - CVE-2025-53364
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Parse Server has an OAuth login vulnerability - CVE-2025-30168

Tags:

npm

parse-server