-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-server | npm | < 6.5.9 | 6.5.9 |
| parse-server | npm | >= 7.0.0, < 7.3.0 | 7.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The user creation endpoint (handleCreate in ClassesRouter) didn't prevent object IDs starting with 'role:' which are reserved for system roles. 2) The session authentication logic (getAuthForSessionToken in Auth.js) didn't invalidate existing sessions using these poisoned IDs. The commit diffs show added validation in both locations - object ID prefix check during user creation and session token validation - confirming these were the vulnerable points before patching.
JavaScriptJavaScriptOngoing coverage of React2Shell