Parse Community
Monthly
Missing authorization in Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 allows unauthenticated REST API clients on MongoDB deployments to delete the internal _SCHEMA collection, stripping class field definitions, class-level permissions and protected fields so affected data becomes readable and modifiable by any client. PostgreSQL deployments are explicitly not affected and object ACLs continue to apply; no public exploit has been identified at time of analysis. The vendor and independent assessment rate this high severity (CVSS 8.8, assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and a near-term priority for MongoDB-backed installations with reachable REST endpoints; vendor patches are available for both affected release branches.
An authentication bypass in Parse Server affects 8.x releases before 8.6.102 and 9.0.0 through 9.10.5-alpha.2 when an app is configured with a custom authentication adapter written as a subclass of the exported AuthAdapter class: Parse Server never invokes the subclass's validateSetUp, validateLogin, and validateUpdate methods and instead falls back to an inherited base-class default that accepts any authData. For any provider served by such an adapter, unauthenticated remote attackers can supply arbitrary authData to sign up, link an identity, log in as an existing user, or skip a custom adapter that implements an additional authentication factor, potentially gaining full account access and integrity over affected data. Apps using built-in adapters or custom adapters defined as plain objects are not affected, and no public exploit code was identified at time of analysis; the priority label from the reporting feed is act_now, reflecting that the impact is severe for the narrower population that matches the configuration prerequisite.
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Denial of service in Parse Server allows remote attackers to crash the Node.js process by writing an object that contains a file reference without a URL into a class that has Cloud Code save/find/delete triggers or LiveQuery enabled. Unauthenticated exploitation is possible only where the deployment allows public write access or open sign-up; instances enforcing authenticated writes via ACLs or Class-Level Permissions require an account with write rights, so exposure is bounded. The flaw is an uncaught exception (CWE-248) that terminates the server process and can break subsequent requests until restart. No public exploit code was identified at time of analysis, and impact is confined to availability (no confidentiality or integrity loss).
Parse Server deployments running versions 9.0.0 through 9.10.1-alpha.9 or 8.0.2 through 8.6.90 that enable code-based social login adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) fail to re-verify provider credentials when authentication data is submitted alongside a username and password on the login endpoint. An authenticated attacker holding a low-privileged account can therefore attach an arbitrary, unverified external provider identity to their own account - or pre-claim the provider ID of a victim who has not yet linked that provider, so the victim's later legitimate provider sign-in lands on the attacker's account. Exploitation is conditional: it requires a non-default adapter to be configured and a valid authenticated session, and the pre-hijack variant additionally requires the targeted victim to complete a legitimate provider login. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed risk is a genuine but conditional authentication flaw rather than a mass-exploitation threat.
Parse Server LiveQuery, the platform's real-time subscription component, can leak field values that the REST API properly withholds, affecting releases from 9.0.0 up to (but not including) 9.10.1-alpha.8 and all versions below 8.6.89. An authenticated subscriber (CVSS vectors for this issue specify PR:L, i.e. authenticated) can receive redacted-eligible field values and even use a masked field as a subscription filter, because LiveQuery evaluates the class-level protectedFields permission against an incompletely resolved caller identity: subscriber roles are never resolved, and when a subscription omits its own session token the payload is redacted against an anonymous identity even though the underlying read was authorized as the connected user. Only classes with LiveQuery enabled that define protectedFields under a role: group, the authenticated group, or a per-user group are exposed; masks defined under the public (*) group behave correctly, and only the specific masked fields are disclosed rather than arbitrary data, so this is a genuine but access-gated disclosure issue rather than an urgent one. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, and vendor-released patches (9.10.1-alpha.8 and 8.6.89) are available.
Unauthenticated remote attackers can delete every device registration in a Parse Server application - or any attacker-chosen subset - by submitting non-string (object) values in installation/device-token fields that are used to build the deduplication query without type validation. The only prerequisite is knowledge of the public application ID, which is intentionally distributed inside client apps; no account, session token, master key, or user interaction is required, and the destructive cleanup runs with elevated privileges before class-level permissions are evaluated. Parse Server versions prior to 8.6.90 and 9.0.0 through 9.10.1-alpha.9 are affected in the default configuration that exposes the REST API to clients and uses push notifications, and because deleted registrations cannot be recovered server-side, push delivery halts until every client re-registers; no public exploit identified at time of analysis, and the vendor-released patch is 8.6.90 or 9.10.1-alpha.9.
Authentication bypass in Parse Server's built-in LDAP authentication adapter (versions <= 8.6.87 and 9.0.0 through 9.10.1-alpha.6) lets an unauthenticated attacker who knows a valid directory username obtain a session token for that account, resulting in full account takeover. The adapter forwarded a client-supplied empty password to the directory and treated any non-error bind response as successful authentication, so a zero-length credential triggers an RFC 4513 unauthenticated-simple-bind that directories like Active Directory answer with success. No public exploit identified at time of analysis, but the flaw is trivial to trigger against affected LDAP-backed deployments.
Parse Server versions prior to 8.6.71 and 9.7.1-alpha.1 allow HTTP Range requests to bypass the afterFind trigger and its validators when downloading files from streaming-capable storage adapters like GridFS, enabling unauthorized access to protected files that should be restricted by authentication or authorization logic. This authentication bypass affects all deployments using affected versions with file protection policies enforced via afterFind triggers.
GraphQL query complexity validator in Parse Server allows remote denial-of-service via crafted queries with binary fan-out fragment spreads, blocking the Node.js event loop for seconds with a single unauthenticated request. Parse Server versions prior to 8.6.68 and 9.7.0-alpha.12 are affected when requestComplexity.graphQLDepth or requestComplexity.graphQLFields options are enabled. EPSS data not provided; no public exploit identified at time of analysis. CVSS 8.2 (High) reflects network-accessible attack with low complexity requiring no privileges, causing high availability impact.
Parse Server Cloud Function validator bypass allows unauthenticated remote attackers to execute protected server-side functions by exploiting prototype chain traversal. Attackers append 'prototype.constructor' to Cloud Function URLs to circumvent access controls (requireUser, requireMaster, custom validators), enabling unauthorized execution of backend business logic. Affects Parse Server versions prior to 8.6.67 and 9.7.0-alpha.11. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity (CVSS:4.0 AV:N/AC:L/PR:N). The vulnerability stems from inconsistent prototype chain resolution between handler and validator stores (CWE-863: Incorrect Authorization).
Parse Server versions prior to 8.6.61 and 9.6.0-alpha.55 expose sensitive authentication credentials to authenticated users via the GET /users/me endpoint, including MFA TOTP secrets and recovery codes that should be sanitized. An attacker who obtains a valid user session token can extract these MFA secrets to bypass multi-factor authentication indefinitely and gain unauthorized access to accounts. No CVSS score or EPSS data is currently available, but the vulnerability has confirmed patches available in stable and alpha releases.
Parse Server versions prior to 8.6.59 and 9.6.0-alpha.53 contain a SQL injection vulnerability in PostgreSQL aggregate operations that allows attackers with master key access to execute arbitrary SQL statements, escalating from application-level administrator privileges to database-level access. Only PostgreSQL-backed Parse Server deployments are affected; MongoDB deployments are not vulnerable. No CVSS score or EPSS data is currently available, and no KEV or active exploitation reports have been confirmed at this time.
An unauthenticated denial-of-service vulnerability exists in Parse Server versions prior to 8.6.58 and 9.6.0-alpha.52, where attackers can submit authentication requests with arbitrary, unconfigured provider names to trigger expensive unindexed database queries. Each malicious request causes a full collection scan on the user database, and since these requests can be parallelized, an attacker can rapidly exhaust database resources and degrade service availability. The vulnerability requires no authentication or special privileges, making it trivial to exploit at scale, and patches are available in the referenced versions.
Parse Server versions prior to 8.6.40 and 9.6.0-alpha.14 contain an authentication bypass vulnerability in their GraphQL WebSocket subscription endpoint that circumvents Express middleware security controls. An unauthenticated attacker can connect directly to the WebSocket endpoint to execute arbitrary GraphQL operations, perform schema introspection despite disabled public introspection, and send complex queries that bypass rate limiting and complexity validation. This is a network-accessible vulnerability requiring no authentication that exposes sensitive schema information and enables potential denial-of-service attacks.
Parse Server fails to reject reserved internal field names in client-supplied object writes, so any client with write access to a class can store an object containing an internal field that breaks every subsequent read of that object on MongoDB, disrupting queries for all users of that class until the field is removed from the database. The same gap lets a user clear internal fields on records they may write - notably the account lockout state and password history of their own account - bypassing lockout and password policy enforcement on both MongoDB and PostgreSQL deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixes in 8.6.100 and 9.10.4-alpha.3.
SMS multi-factor authentication login-code requests in Parse Server are persisted with master privileges, letting an authenticated user who is enrolled in SMS MFA smuggle extra account fields into that request so they are written to their own record with restrictions bypassed. Successful abuse allows integrity-only changes to self-owned data, such as flipping the email-verification flag or setting values normally protected by beforeSave triggers; other users' records cannot be touched. The flaw affects only deployments using the built-in SMS MFA adapter with enrolled accounts, in versions before 8.6.104 and 9.0.0 through 9.10.5-alpha.5, and no public exploit identified at time of analysis while vendor patches are available.
LiveQuery subscription isolation fails in Parse Server (versions 9.0.0 up to 9.10.5-alpha.4 and 8.x through 8.6.102), allowing an authenticated client to receive LiveQuery events that belong to another user - including _Session events carrying session tokens that can be used to impersonate the victim. The flaw only manifests when an application uses a $or operator in its subscription query and depends on constraints placed next to that $or for isolation, such as the server-added owner filter on _Session or a constraint injected by a beforeSubscribe trigger, and it additionally requires a second client to be concurrently subscribed so the two subscriptions get grouped by the flawed hash. This is a conditional, configuration-dependent information disclosure rather than a universal authentication bypass: ACLs, class-level permissions and protected fields are still enforced per client, so only isolation that lives purely in query constraints is lost. No public exploit code has been identified and the issue is not in CISA KEV; the vendor has released fixes and the overall priority is to schedule patching this month.
Parse Server fails to enforce class-level create and addField permissions on its built-in _Session class, allowing an authenticated user-or anyone holding that user's valid session token-to create additional persistent sessions and add fields to _Session through POST requests to /sessions or /classes/_Session. Affected releases are Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1; sessions created this way are not revoked when the original session is logged out. Impact is limited to session integrity with no confidentiality or availability loss, and no public exploit code was identified at time of analysis.
Unauthenticated remote attackers can exploit Parse Server user-update handling to confirm guessed usernames and email addresses and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is configured, validate guessed current or previous passwords while bypassing account lockout. The flaw results from target-account checks being evaluated before caller authorization; affected releases are prior to 8.6.99 and 9.0.0 through 9.10.3-alpha.2. No public exploit code has been identified at time of analysis, and the primary impact is credential enumeration rather than direct compromise.
Authenticated users can infer the size and membership of protected Parse Server Relation fields by issuing count queries with the $relatedTo operator before 8.6.93 and in the 9.0.0 line before 9.10.1-alpha.13. The flaw bypasses identity-scoped protectedFields for authenticated, role, or per-user group rules and can act as a membership oracle when combined with an objectId constraint, leaking confidential relation membership such as private groups or block lists. The issue has a CVSS 4.0 score of 5.3, requires prior read access to the owning object, and no public exploit has been identified at time of analysis.
GraphQL schema disclosure in Parse Server allows unauthenticated attackers who hold the public Application ID and client key to recover private class and field names by replaying an introspection operation cached in Apollo Server's automatic persisted query (APQ) registry, because the server's introspection restriction is enforced only against operation text sent with the request and not against operations resolved from the cache. Exploitation is not autonomous: it requires the GraphQL API to be enabled and network-reachable and, critically, that a master- or maintenance-key client has already executed and cached an introspection query, so the attacker replays that privileged cached entry rather than submitting introspection text directly - a prerequisite captured as Attack Requirements: Present in the CVSS 4.0 vector and reflected in an independent rescoring of AV:N/AC:H. Impact is limited to information disclosure (no data modification, no code execution, no server compromise); no public exploit code was identified at time of analysis.
GraphQL validation error messages in Parse Server leak hidden class names to unauthenticated remote attackers who hold only the deployment's public Application Id. The flaw affects the 8.x line from 8.2.2 up to (but not including) 8.6.92 and the 9.x line from 9.0.0 up to (but not including) 9.10.1-alpha.12, and manifests specifically when the GraphQL API is enabled with public introspection disabled: crafted operations that provoke unknown-argument or invalid-enum-value errors still return text naming pointer and relation target classes, letting an attacker enumerate internal schema structure. Impact is confined to confidentiality (CWE-209, CVSS 3.1 C:L, no integrity or availability effect), there is no public exploit identified at time of analysis, the issue is not listed in CISA KEV, and vendor fixes are available in 8.6.92 and 9.10.1-alpha.12.
Information disclosure in Parse Server GraphQL endpoint allows unauthenticated clients to learn names of required custom fields by triggering validation errors, partially bypassing schema hiding when public introspection is disabled. Affects versions 8.2.2 to 8.6.85 and 9.0.0 to 9.9.x; patched in 8.6.86 and 9.10.0-alpha.5. No active exploitation or public exploit code identified.
Information disclosure in Parse Server GraphQL error messages exposes hidden schema class names to unauthenticated attackers when public schema introspection is disabled. Affects versions 9.0.0 before 9.10.0-alpha.6 and 8.2.2 before 8.6.87. Only class names are disclosed, not object data; no public exploit or active exploitation identified.
Schema identifier disclosure in Parse Server allows unauthenticated callers to reconstruct hidden GraphQL schema elements by exploiting 'Did you mean ...?' suggestions emitted during variable coercion error handling - a pathway left ungated by the graphQLPublicIntrospection: false hardening control, which only covered the validation phase. Affected versions span the 9.x line (9.0.0 through 9.10.0-alpha.4) and the 8.x line (before 8.6.85), and the flaw represents a confirmed bypass of prior fix GHSA-8cph-rgr4-g5vj. An attacker bearing only the public application ID can iteratively enumerate Cloud Code function names, Parse class names, and field names without triggering the introspection guard; no public exploit code is confirmed and no CISA KEV listing is present at time of analysis.
Stored XSS execution in Parse Server (versions 9.0.0 through pre-9.10.0-alpha.2 and all 8.x releases through 8.6.83) allows authenticated users with file-upload permissions to inject persistent JavaScript that executes in the application's origin against other users, but only when a cloud-based storage adapter is configured. By crafting a deliberately malformed Content-Type header - such as 'image' or 'image/' - an attacker exploits a gap in the mime-package lookup path that renders the fileUpload.fileExtensions blocklist ineffective, causing the malformed value to be stored verbatim in Amazon S3, Google Cloud Storage, or Azure Blob Storage. Browsers receiving a syntactically invalid Content-Type fall back to MIME sniffing and render HTML file bodies as web pages in the application's origin; no public exploit has been identified and the vulnerability is absent from CISA KEV, but the stored nature means a single successful upload persists as a live threat until patched or the file is removed.
Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required.
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required.
Unauthenticated relation membership disclosure in Parse Server allows any client holding only standard public API credentials to read objects linked through a Relation field that is explicitly hidden by protectedFields, or linked to a parent object that is inaccessible under its ACL or class-level permissions. By supplying only a known or guessed owning object's objectId, a remote unauthenticated caller can enumerate all objects in a protected relation or use the $relatedTo operator as a membership oracle - confirming whether a specific child object is privately linked to a given parent. This directly undermines applications that use Parse Server's access control primitives to protect sensitive relationships such as private group memberships, block lists, or account-to-resource associations. No public exploit identified at time of analysis; vendor-released patches exist at versions 8.6.80 and 9.9.1-alpha.6.
Parse Server 9.8.0-9.9.0 exposes raw MFA TOTP secrets and recovery codes through the /verifyPassword and /login endpoints when the _User class-level permission (CLP) is configured to deny get operations. An attacker with knowledge of a victim's username and password can call /verifyPassword without a session token or MFA token and receive the victim's plaintext TOTP secret and recovery codes in the response, completely defeating the second authentication factor. No public exploit has been identified at time of analysis; a patch exists in version 9.9.1-alpha.5, and the EPSS score of 0.04% (13th percentile) reflects limited opportunistic exploitation so far.
Stored XSS in Parse Server is achievable by authenticated users who bypass the file upload extension blocklist by appending a trailing dot to a blocked filename (e.g., `poc.svg.`), causing the extension parser to return an empty string and skip the block check. The attacker-supplied Content-Type is forwarded unchanged to cloud storage adapters (S3, GCS), which persist and serve the file under that active MIME type - enabling script execution in a victim's browser when the file URL is opened. No active exploitation is confirmed (not in CISA KEV, EPSS 0.05% at 15th percentile), but the attack mechanism is low-complexity and fully documented in the vendor's fix PRs. Patches are available in versions 8.6.79 and 9.9.1-alpha.4.
Parse Server's operator-configured route firewall (`routeAllowList`) is bypassed in versions 9.8.0 through 9.9.1-alpha.3 when external clients POST to the `/batch` endpoint with sub-requests targeting routes the operator intended to block. The Express middleware enforcing the allow-list runs only against the outer HTTP request URL; the `/batch` handler dispatches each embedded sub-request to the internal router without re-running that check. Inner authorization controls - Parse authentication, ACL, and CLP - remain in effect, bounding actual data exposure to whatever those controls permit, but the route-level security boundary is defeated entirely. No public exploit has been identified and EPSS is 0.08%, though operators relying on `routeAllowList` as a primary access-control layer are directly and materially affected.
Parse Server versions prior to 9.8.0-alpha.7 and 8.6.75 expose protected session fields to authenticated users via the GET /sessions/me endpoint, bypassing the protectedFields server configuration that should restrict access to sensitive data. An authenticated attacker can retrieve their own session's protected fields in a single request, whereas the equivalent GET /sessions and GET /sessions/:objectId endpoints correctly enforce field-level access controls. This information disclosure vulnerability affects any Parse Server deployment where administrators have configured protected fields on the _Session class and expects those fields to remain confidential from users.
Parse Server versions prior to 8.6.70 and 9.7.0-alpha.18 allow authenticated users with find class-level permissions to bypass protectedFields restrictions on LiveQuery subscriptions by submitting array-like objects with numeric keys instead of proper arrays in $or, $and, or $nor operators. This enables information disclosure through a binary oracle attack that reveals whether protected fields match attacker-supplied values. The vulnerability requires prior authentication and find-level access but no user interaction, affecting all deployments of vulnerable Parse Server versions.
Authenticated users in Parse Server prior to versions 8.6.69 and 9.7.0-alpha.14 can bypass immutability protections on session fields by submitting null values in PUT requests to the session update endpoint, allowing indefinite session validity and circumventing configured session expiration policies. The vulnerability requires valid authentication credentials to exploit and has been patched in the specified versions.
Parse Server versions prior to 8.6.60 and 9.6.0-alpha.54 contain a race condition vulnerability that allows attackers to reuse single-use MFA recovery codes an unlimited number of times through concurrent login requests. An attacker with knowledge of a user's password and possession of one valid recovery code can bypass the intended single-use restriction by sending multiple authentication attempts simultaneously within milliseconds, effectively defeating the multi-factor authentication protection mechanism. This vulnerability is tracked as CWE-367 (TOCTOU race condition) and has been patched in the aforementioned versions with fixes available via pull requests 10275 and 10276.
Missing authorization in Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 allows unauthenticated REST API clients on MongoDB deployments to delete the internal _SCHEMA collection, stripping class field definitions, class-level permissions and protected fields so affected data becomes readable and modifiable by any client. PostgreSQL deployments are explicitly not affected and object ACLs continue to apply; no public exploit has been identified at time of analysis. The vendor and independent assessment rate this high severity (CVSS 8.8, assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and a near-term priority for MongoDB-backed installations with reachable REST endpoints; vendor patches are available for both affected release branches.
An authentication bypass in Parse Server affects 8.x releases before 8.6.102 and 9.0.0 through 9.10.5-alpha.2 when an app is configured with a custom authentication adapter written as a subclass of the exported AuthAdapter class: Parse Server never invokes the subclass's validateSetUp, validateLogin, and validateUpdate methods and instead falls back to an inherited base-class default that accepts any authData. For any provider served by such an adapter, unauthenticated remote attackers can supply arbitrary authData to sign up, link an identity, log in as an existing user, or skip a custom adapter that implements an additional authentication factor, potentially gaining full account access and integrity over affected data. Apps using built-in adapters or custom adapters defined as plain objects are not affected, and no public exploit code was identified at time of analysis; the priority label from the reporting feed is act_now, reflecting that the impact is severe for the narrower population that matches the configuration prerequisite.
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Denial of service in Parse Server allows remote attackers to crash the Node.js process by writing an object that contains a file reference without a URL into a class that has Cloud Code save/find/delete triggers or LiveQuery enabled. Unauthenticated exploitation is possible only where the deployment allows public write access or open sign-up; instances enforcing authenticated writes via ACLs or Class-Level Permissions require an account with write rights, so exposure is bounded. The flaw is an uncaught exception (CWE-248) that terminates the server process and can break subsequent requests until restart. No public exploit code was identified at time of analysis, and impact is confined to availability (no confidentiality or integrity loss).
Parse Server deployments running versions 9.0.0 through 9.10.1-alpha.9 or 8.0.2 through 8.6.90 that enable code-based social login adapters (GitHub, Google Play Games, Instagram, LINE, LinkedIn, Microsoft, QQ, Spotify, WeChat, Weibo) fail to re-verify provider credentials when authentication data is submitted alongside a username and password on the login endpoint. An authenticated attacker holding a low-privileged account can therefore attach an arbitrary, unverified external provider identity to their own account - or pre-claim the provider ID of a victim who has not yet linked that provider, so the victim's later legitimate provider sign-in lands on the attacker's account. Exploitation is conditional: it requires a non-default adapter to be configured and a valid authenticated session, and the pre-hijack variant additionally requires the targeted victim to complete a legitimate provider login. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed risk is a genuine but conditional authentication flaw rather than a mass-exploitation threat.
Parse Server LiveQuery, the platform's real-time subscription component, can leak field values that the REST API properly withholds, affecting releases from 9.0.0 up to (but not including) 9.10.1-alpha.8 and all versions below 8.6.89. An authenticated subscriber (CVSS vectors for this issue specify PR:L, i.e. authenticated) can receive redacted-eligible field values and even use a masked field as a subscription filter, because LiveQuery evaluates the class-level protectedFields permission against an incompletely resolved caller identity: subscriber roles are never resolved, and when a subscription omits its own session token the payload is redacted against an anonymous identity even though the underlying read was authorized as the connected user. Only classes with LiveQuery enabled that define protectedFields under a role: group, the authenticated group, or a per-user group are exposed; masks defined under the public (*) group behave correctly, and only the specific masked fields are disclosed rather than arbitrary data, so this is a genuine but access-gated disclosure issue rather than an urgent one. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, and vendor-released patches (9.10.1-alpha.8 and 8.6.89) are available.
Unauthenticated remote attackers can delete every device registration in a Parse Server application - or any attacker-chosen subset - by submitting non-string (object) values in installation/device-token fields that are used to build the deduplication query without type validation. The only prerequisite is knowledge of the public application ID, which is intentionally distributed inside client apps; no account, session token, master key, or user interaction is required, and the destructive cleanup runs with elevated privileges before class-level permissions are evaluated. Parse Server versions prior to 8.6.90 and 9.0.0 through 9.10.1-alpha.9 are affected in the default configuration that exposes the REST API to clients and uses push notifications, and because deleted registrations cannot be recovered server-side, push delivery halts until every client re-registers; no public exploit identified at time of analysis, and the vendor-released patch is 8.6.90 or 9.10.1-alpha.9.
Authentication bypass in Parse Server's built-in LDAP authentication adapter (versions <= 8.6.87 and 9.0.0 through 9.10.1-alpha.6) lets an unauthenticated attacker who knows a valid directory username obtain a session token for that account, resulting in full account takeover. The adapter forwarded a client-supplied empty password to the directory and treated any non-error bind response as successful authentication, so a zero-length credential triggers an RFC 4513 unauthenticated-simple-bind that directories like Active Directory answer with success. No public exploit identified at time of analysis, but the flaw is trivial to trigger against affected LDAP-backed deployments.
Parse Server versions prior to 8.6.71 and 9.7.1-alpha.1 allow HTTP Range requests to bypass the afterFind trigger and its validators when downloading files from streaming-capable storage adapters like GridFS, enabling unauthorized access to protected files that should be restricted by authentication or authorization logic. This authentication bypass affects all deployments using affected versions with file protection policies enforced via afterFind triggers.
GraphQL query complexity validator in Parse Server allows remote denial-of-service via crafted queries with binary fan-out fragment spreads, blocking the Node.js event loop for seconds with a single unauthenticated request. Parse Server versions prior to 8.6.68 and 9.7.0-alpha.12 are affected when requestComplexity.graphQLDepth or requestComplexity.graphQLFields options are enabled. EPSS data not provided; no public exploit identified at time of analysis. CVSS 8.2 (High) reflects network-accessible attack with low complexity requiring no privileges, causing high availability impact.
Parse Server Cloud Function validator bypass allows unauthenticated remote attackers to execute protected server-side functions by exploiting prototype chain traversal. Attackers append 'prototype.constructor' to Cloud Function URLs to circumvent access controls (requireUser, requireMaster, custom validators), enabling unauthorized execution of backend business logic. Affects Parse Server versions prior to 8.6.67 and 9.7.0-alpha.11. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity (CVSS:4.0 AV:N/AC:L/PR:N). The vulnerability stems from inconsistent prototype chain resolution between handler and validator stores (CWE-863: Incorrect Authorization).
Parse Server versions prior to 8.6.61 and 9.6.0-alpha.55 expose sensitive authentication credentials to authenticated users via the GET /users/me endpoint, including MFA TOTP secrets and recovery codes that should be sanitized. An attacker who obtains a valid user session token can extract these MFA secrets to bypass multi-factor authentication indefinitely and gain unauthorized access to accounts. No CVSS score or EPSS data is currently available, but the vulnerability has confirmed patches available in stable and alpha releases.
Parse Server versions prior to 8.6.59 and 9.6.0-alpha.53 contain a SQL injection vulnerability in PostgreSQL aggregate operations that allows attackers with master key access to execute arbitrary SQL statements, escalating from application-level administrator privileges to database-level access. Only PostgreSQL-backed Parse Server deployments are affected; MongoDB deployments are not vulnerable. No CVSS score or EPSS data is currently available, and no KEV or active exploitation reports have been confirmed at this time.
An unauthenticated denial-of-service vulnerability exists in Parse Server versions prior to 8.6.58 and 9.6.0-alpha.52, where attackers can submit authentication requests with arbitrary, unconfigured provider names to trigger expensive unindexed database queries. Each malicious request causes a full collection scan on the user database, and since these requests can be parallelized, an attacker can rapidly exhaust database resources and degrade service availability. The vulnerability requires no authentication or special privileges, making it trivial to exploit at scale, and patches are available in the referenced versions.
Parse Server versions prior to 8.6.40 and 9.6.0-alpha.14 contain an authentication bypass vulnerability in their GraphQL WebSocket subscription endpoint that circumvents Express middleware security controls. An unauthenticated attacker can connect directly to the WebSocket endpoint to execute arbitrary GraphQL operations, perform schema introspection despite disabled public introspection, and send complex queries that bypass rate limiting and complexity validation. This is a network-accessible vulnerability requiring no authentication that exposes sensitive schema information and enables potential denial-of-service attacks.
Parse Server fails to reject reserved internal field names in client-supplied object writes, so any client with write access to a class can store an object containing an internal field that breaks every subsequent read of that object on MongoDB, disrupting queries for all users of that class until the field is removed from the database. The same gap lets a user clear internal fields on records they may write - notably the account lockout state and password history of their own account - bypassing lockout and password policy enforcement on both MongoDB and PostgreSQL deployments. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixes in 8.6.100 and 9.10.4-alpha.3.
SMS multi-factor authentication login-code requests in Parse Server are persisted with master privileges, letting an authenticated user who is enrolled in SMS MFA smuggle extra account fields into that request so they are written to their own record with restrictions bypassed. Successful abuse allows integrity-only changes to self-owned data, such as flipping the email-verification flag or setting values normally protected by beforeSave triggers; other users' records cannot be touched. The flaw affects only deployments using the built-in SMS MFA adapter with enrolled accounts, in versions before 8.6.104 and 9.0.0 through 9.10.5-alpha.5, and no public exploit identified at time of analysis while vendor patches are available.
LiveQuery subscription isolation fails in Parse Server (versions 9.0.0 up to 9.10.5-alpha.4 and 8.x through 8.6.102), allowing an authenticated client to receive LiveQuery events that belong to another user - including _Session events carrying session tokens that can be used to impersonate the victim. The flaw only manifests when an application uses a $or operator in its subscription query and depends on constraints placed next to that $or for isolation, such as the server-added owner filter on _Session or a constraint injected by a beforeSubscribe trigger, and it additionally requires a second client to be concurrently subscribed so the two subscriptions get grouped by the flawed hash. This is a conditional, configuration-dependent information disclosure rather than a universal authentication bypass: ACLs, class-level permissions and protected fields are still enforced per client, so only isolation that lives purely in query constraints is lost. No public exploit code has been identified and the issue is not in CISA KEV; the vendor has released fixes and the overall priority is to schedule patching this month.
Parse Server fails to enforce class-level create and addField permissions on its built-in _Session class, allowing an authenticated user-or anyone holding that user's valid session token-to create additional persistent sessions and add fields to _Session through POST requests to /sessions or /classes/_Session. Affected releases are Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1; sessions created this way are not revoked when the original session is logged out. Impact is limited to session integrity with no confidentiality or availability loss, and no public exploit code was identified at time of analysis.
Unauthenticated remote attackers can exploit Parse Server user-update handling to confirm guessed usernames and email addresses and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is configured, validate guessed current or previous passwords while bypassing account lockout. The flaw results from target-account checks being evaluated before caller authorization; affected releases are prior to 8.6.99 and 9.0.0 through 9.10.3-alpha.2. No public exploit code has been identified at time of analysis, and the primary impact is credential enumeration rather than direct compromise.
Authenticated users can infer the size and membership of protected Parse Server Relation fields by issuing count queries with the $relatedTo operator before 8.6.93 and in the 9.0.0 line before 9.10.1-alpha.13. The flaw bypasses identity-scoped protectedFields for authenticated, role, or per-user group rules and can act as a membership oracle when combined with an objectId constraint, leaking confidential relation membership such as private groups or block lists. The issue has a CVSS 4.0 score of 5.3, requires prior read access to the owning object, and no public exploit has been identified at time of analysis.
GraphQL schema disclosure in Parse Server allows unauthenticated attackers who hold the public Application ID and client key to recover private class and field names by replaying an introspection operation cached in Apollo Server's automatic persisted query (APQ) registry, because the server's introspection restriction is enforced only against operation text sent with the request and not against operations resolved from the cache. Exploitation is not autonomous: it requires the GraphQL API to be enabled and network-reachable and, critically, that a master- or maintenance-key client has already executed and cached an introspection query, so the attacker replays that privileged cached entry rather than submitting introspection text directly - a prerequisite captured as Attack Requirements: Present in the CVSS 4.0 vector and reflected in an independent rescoring of AV:N/AC:H. Impact is limited to information disclosure (no data modification, no code execution, no server compromise); no public exploit code was identified at time of analysis.
GraphQL validation error messages in Parse Server leak hidden class names to unauthenticated remote attackers who hold only the deployment's public Application Id. The flaw affects the 8.x line from 8.2.2 up to (but not including) 8.6.92 and the 9.x line from 9.0.0 up to (but not including) 9.10.1-alpha.12, and manifests specifically when the GraphQL API is enabled with public introspection disabled: crafted operations that provoke unknown-argument or invalid-enum-value errors still return text naming pointer and relation target classes, letting an attacker enumerate internal schema structure. Impact is confined to confidentiality (CWE-209, CVSS 3.1 C:L, no integrity or availability effect), there is no public exploit identified at time of analysis, the issue is not listed in CISA KEV, and vendor fixes are available in 8.6.92 and 9.10.1-alpha.12.
Information disclosure in Parse Server GraphQL endpoint allows unauthenticated clients to learn names of required custom fields by triggering validation errors, partially bypassing schema hiding when public introspection is disabled. Affects versions 8.2.2 to 8.6.85 and 9.0.0 to 9.9.x; patched in 8.6.86 and 9.10.0-alpha.5. No active exploitation or public exploit code identified.
Information disclosure in Parse Server GraphQL error messages exposes hidden schema class names to unauthenticated attackers when public schema introspection is disabled. Affects versions 9.0.0 before 9.10.0-alpha.6 and 8.2.2 before 8.6.87. Only class names are disclosed, not object data; no public exploit or active exploitation identified.
Schema identifier disclosure in Parse Server allows unauthenticated callers to reconstruct hidden GraphQL schema elements by exploiting 'Did you mean ...?' suggestions emitted during variable coercion error handling - a pathway left ungated by the graphQLPublicIntrospection: false hardening control, which only covered the validation phase. Affected versions span the 9.x line (9.0.0 through 9.10.0-alpha.4) and the 8.x line (before 8.6.85), and the flaw represents a confirmed bypass of prior fix GHSA-8cph-rgr4-g5vj. An attacker bearing only the public application ID can iteratively enumerate Cloud Code function names, Parse class names, and field names without triggering the introspection guard; no public exploit code is confirmed and no CISA KEV listing is present at time of analysis.
Stored XSS execution in Parse Server (versions 9.0.0 through pre-9.10.0-alpha.2 and all 8.x releases through 8.6.83) allows authenticated users with file-upload permissions to inject persistent JavaScript that executes in the application's origin against other users, but only when a cloud-based storage adapter is configured. By crafting a deliberately malformed Content-Type header - such as 'image' or 'image/' - an attacker exploits a gap in the mime-package lookup path that renders the fileUpload.fileExtensions blocklist ineffective, causing the malformed value to be stored verbatim in Amazon S3, Google Cloud Storage, or Azure Blob Storage. Browsers receiving a syntactically invalid Content-Type fall back to MIME sniffing and render HTML file bodies as web pages in the application's origin; no public exploit has been identified and the vulnerability is absent from CISA KEV, but the stored nature means a single successful upload persists as a live threat until patched or the file is removed.
Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required.
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required.
Unauthenticated relation membership disclosure in Parse Server allows any client holding only standard public API credentials to read objects linked through a Relation field that is explicitly hidden by protectedFields, or linked to a parent object that is inaccessible under its ACL or class-level permissions. By supplying only a known or guessed owning object's objectId, a remote unauthenticated caller can enumerate all objects in a protected relation or use the $relatedTo operator as a membership oracle - confirming whether a specific child object is privately linked to a given parent. This directly undermines applications that use Parse Server's access control primitives to protect sensitive relationships such as private group memberships, block lists, or account-to-resource associations. No public exploit identified at time of analysis; vendor-released patches exist at versions 8.6.80 and 9.9.1-alpha.6.
Parse Server 9.8.0-9.9.0 exposes raw MFA TOTP secrets and recovery codes through the /verifyPassword and /login endpoints when the _User class-level permission (CLP) is configured to deny get operations. An attacker with knowledge of a victim's username and password can call /verifyPassword without a session token or MFA token and receive the victim's plaintext TOTP secret and recovery codes in the response, completely defeating the second authentication factor. No public exploit has been identified at time of analysis; a patch exists in version 9.9.1-alpha.5, and the EPSS score of 0.04% (13th percentile) reflects limited opportunistic exploitation so far.
Stored XSS in Parse Server is achievable by authenticated users who bypass the file upload extension blocklist by appending a trailing dot to a blocked filename (e.g., `poc.svg.`), causing the extension parser to return an empty string and skip the block check. The attacker-supplied Content-Type is forwarded unchanged to cloud storage adapters (S3, GCS), which persist and serve the file under that active MIME type - enabling script execution in a victim's browser when the file URL is opened. No active exploitation is confirmed (not in CISA KEV, EPSS 0.05% at 15th percentile), but the attack mechanism is low-complexity and fully documented in the vendor's fix PRs. Patches are available in versions 8.6.79 and 9.9.1-alpha.4.
Parse Server's operator-configured route firewall (`routeAllowList`) is bypassed in versions 9.8.0 through 9.9.1-alpha.3 when external clients POST to the `/batch` endpoint with sub-requests targeting routes the operator intended to block. The Express middleware enforcing the allow-list runs only against the outer HTTP request URL; the `/batch` handler dispatches each embedded sub-request to the internal router without re-running that check. Inner authorization controls - Parse authentication, ACL, and CLP - remain in effect, bounding actual data exposure to whatever those controls permit, but the route-level security boundary is defeated entirely. No public exploit has been identified and EPSS is 0.08%, though operators relying on `routeAllowList` as a primary access-control layer are directly and materially affected.
Parse Server versions prior to 9.8.0-alpha.7 and 8.6.75 expose protected session fields to authenticated users via the GET /sessions/me endpoint, bypassing the protectedFields server configuration that should restrict access to sensitive data. An authenticated attacker can retrieve their own session's protected fields in a single request, whereas the equivalent GET /sessions and GET /sessions/:objectId endpoints correctly enforce field-level access controls. This information disclosure vulnerability affects any Parse Server deployment where administrators have configured protected fields on the _Session class and expects those fields to remain confidential from users.
Parse Server versions prior to 8.6.70 and 9.7.0-alpha.18 allow authenticated users with find class-level permissions to bypass protectedFields restrictions on LiveQuery subscriptions by submitting array-like objects with numeric keys instead of proper arrays in $or, $and, or $nor operators. This enables information disclosure through a binary oracle attack that reveals whether protected fields match attacker-supplied values. The vulnerability requires prior authentication and find-level access but no user interaction, affecting all deployments of vulnerable Parse Server versions.
Authenticated users in Parse Server prior to versions 8.6.69 and 9.7.0-alpha.14 can bypass immutability protections on session fields by submitting null values in PUT requests to the session update endpoint, allowing indefinite session validity and circumventing configured session expiration policies. The vulnerability requires valid authentication credentials to exploit and has been patched in the specified versions.
Parse Server versions prior to 8.6.60 and 9.6.0-alpha.54 contain a race condition vulnerability that allows attackers to reuse single-use MFA recovery codes an unlimited number of times through concurrent login requests. An attacker with knowledge of a user's password and possession of one valid recovery code can bypass the intended single-use restriction by sending multiple authentication attempts simultaneously within milliseconds, effectively defeating the multi-factor authentication protection mechanism. This vulnerability is tracked as CWE-367 (TOCTOU race condition) and has been patched in the aforementioned versions with fixes available via pull requests 10275 and 10276.