Observable discrepancy in parse-server - #VU132205

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose sensitive information about linked accounts and email addresses.

The vulnerability exists due to improper access control in the account linking functionality when handling account linking requests. A remote attacker can guess account identifiers and observe different error responses to disclose sensitive information about linked accounts and email addresses.

The issue arises because different errors are returned before insufficient authorization is checked.

Remediation

Sources

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5
• https://github.com/parse-community/parse-server/commit/73b0f9a339b81f5d757725dc557955a7b670a3ec