CVE-2020-5251: Parseplatform Parse-Server

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.

Affected products

• Parseplatform Parse-Server: before 4.1.0 (fixed in 4.1.0)

Published 2020-03-04. Last modified 2026-06-17.