Parse Server
CVE-2026-30850
MEDIUM
GHSA-hwx8-q9cg-mqmc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.9 (MEDIUM). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Parse Server versions prior to 8.6.9 and 9.5.0-alpha.9 fail to enforce file access control triggers on the metadata endpoint, allowing unauthenticated attackers to retrieve sensitive file metadata that should be restricted. This bypass occurs because beforeFind and afterFind triggers are not invoked when accessing file metadata, circumventing security gates intended to protect file information. Affected organizations using Parse Server without the patched versions face unauthorized disclosure of file metadata.
Earlier versions of this analysis (1)
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. [CVSS 5.9 MEDIUM]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-862 (Missing Authorization). Affects Parse-Server. Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata. This issue has been patched in versions 8.6.9 and 9.5.0-alpha.9.
Know when Parse Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata. This issue has been patched in versions 8.6.9 and 9.5.0-alpha.9.
Executive ViewAI
Organizations using Parse Server should be aware of moderate risk from CVE-2026-30850, a missing authorization vulnerability rated CVSS 5.9. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Parse Server Authorization and Authentication Flaws
View all 4More in Parse Server
View allParse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications.
### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all
Parse Server has a CVSS 10.0 access control vulnerability enabling complete bypass of all data access restrictions.
parse-server is a Parse Server for Node.js / Express. Rated critical severity (CVSS 10.0), this vulnerability is remotel
SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Exploit-DB