Description
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
parse-community parse-server
Default version status: unaffected
9.0.0 to < 9.10.5-alpha.8affected9.10.5-alpha.8unaffected
pkg:npm/parse-serverparse-community parse-server
Default version status: unaffected
0 to < 8.6.107affected8.6.107unaffected
pkg:npm/parse-server