Parse Server, an open-source backend for Node.js, contains an endpoint that returns session information. The /sessions/me route improperly exposes fields that the server operator has marked as protected, allowing any authenticated user to retrieve sensitive data they should not see. This flaw can lead to disclosure of confidential session details and compromise the integrity of the session data, but does not allow a user to access other users’ sessions.

The vulnerability exists in the parse-community:parse-server product, affecting all installations running versions before 9.8.0-alpha.7 and 8.6.75. Updating to those releases or later eliminates the issue.

With a CVSS score of 5.3 the flaw is considered moderate in severity. An attacker only needs to be authenticated against the application to exploit it, and no remote code execution or denial of service is possible. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting the threat of widespread exploitation is limited at present. The remedy is straightforward: upgrade to the fixed versions.