Parse Server EUVD-2026-115945

Exploitation requires two concrete prerequisites. First, the deployment must restrict the create class-level permission of the _Session class - the advisory states plainly that 'Only deployments that restrict the create class-level permission of the _Session class are affected', so default installations without this restriction are not exploitable. Second, the attacker must already possess a valid, already-revocable session token for a user (reflected by PR:L); the endpoint is reached via a REST API POST to /upgradeToRevocableSession (any letter case, with or without trailing slash, including inside batch requests). Limiting factors: the attacker gains no new privileges or data, only additional persistent sessions for an account they can already access; class-level permissions and Cloud Code triggers cannot block this, so the only complete fix is upgrading, with the documented workaround being to block client requests to the /upgradeToRevocableSession path upstream for clients that do not need legacy-token upgrade.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the 2.3 base score describe a network-reachable flaw that requires the attacker to already hold a valid user session token (PR:L) and only affects a narrow deployment mode, with impact limited to integrity (VI:L) and no confidentiality or availability effect - matching CWE-863 (incorrect authorization). The vuln.today decision label is 'monitor', the lowest urgency tier, and there is no CISA KEV listing and no EPSS score in the supplied data, so exploitation probability cannot be quantified from this input. No public exploit reference is labeled in the input (only the vendor advisory and the two fix PRs, which include regression tests), so this is no public exploit identified at time of analysis. The 'AT:P' attack requirement and the advisory's explicit scoping - 'Only deployments that restrict the create class-level permission of the _Session class are affected' - mean most default Parse Server installations are not affected at all. The practical impact is session persistence/proliferation (sessions that survive logout), not account takeover or data disclosure. Net: a real but minor hardening-grade defect, not an emergency; EPSS and KEV data are absent, which is expected for a low-severity flaw rather than a data gap that hides risk.

An attacker who has obtained a legitimate user's already-revocable session token (for example a stolen or leaked token) sends it to the /upgradeToRevocableSession endpoint and receives a brand-new session with a fresh expiration, optionally bound to an installation ID of their choosing. Because the new session is not tied to the original, it continues to work even after the victim logs the original session out, giving the attacker durable access. This only works against deployments that restrict the _Session class create class-level permission; no public exploit code is identified in the supplied data, though the vendor PRs include demonstrating regression tests.