Parse Server
CVE-2026-30965
CRITICAL
GHSA-6r2j-cxgf-495f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate or update object with relation field
-
ExploitExploit redirectClassNameForKey parameter
-
ExecutionExfiltrate session tokens
-
ImpactTakeover user accounts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Parse Server versions prior to 9.5.2-alpha.8 or 8.6.21 with Class-Level Permissions allowing object creation/update on at least one class. Network access to Parse Server instance required. |
| Impact | CVSS 9.1 — Parse Server is a popular open-source backend. Cross-application data access breaks multi-tenant isolation. |
| Exploit ScenarioDerived | An attacker exploits the authorization flaw to access data from other applications hosted on the same Parse Server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications.
Earlier versions of this analysis (1)
Authorization flaw in Parse Server enables cross-application data access.
RemediationAI
Update Parse Server.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Parse Server has a CWE-863 incorrect authorization. First of three Parse Server vulnerabilities.
Know when Parse Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability requires the attacker to be able to create or update an object with a new relation field, which depends on the Class-Level Permissions of at least one class. This vulnerability is fixed in 9.5.2-alpha.8 and 8.6.21.
Executive ViewAI
A critical vulnerability in Parse Server (CVSS 9.1) poses an immediate risk to organizations using this open-source backend platform, with no patch currently available. This affects all deployments and requires urgent mitigation to prevent potential data breaches, service disruption, or unauthorized system access.
Implement network segmentation and firewall rules to restrict Parse Server access; deploy WAF with signatures to detect/block exploitation attempts; disable unnecessary API endpoints and features; enable multi-factor authentication for administrative access; implement rate limiting and DDoS protection; increase monitoring and logging for anomalous activity; consider running Parse Server in isolated containers with minimal privileges; evaluate managed Parse Server alternatives until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Parse Server Multiple Security Flaws
View all 10More in Parse Server
View allParse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all
parse-server is a Parse Server for Node.js / Express. Rated critical severity (CVSS 10.0), this vulnerability is remotel
Authentication bypass in Parse Server allows unauthenticated access to protected API endpoints. Parse Server is a popula
SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Exploit-DB