CVE-2026-30850 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata. This issue has been patched in versions 8.6.9 and 9.5.0-alpha.9.
A vulnerability exists in Parse Server versions prior to 8.6.9 and 9.5.0-alpha.9, where the file metadata endpoint does not properly enforce access control triggers. This oversight allows unauthorized access to file metadata, specifically user-defined key-value pairs, while keeping the actual file content protected. The issue arises because the metadata endpoint bypasses 'beforeFind' and 'afterFind' triggers, which are often used to control access to files.
Users can update to Parse Server versions 8.6.9 or 9.5.0-alpha.9, where this vulnerability has been patched. Alternatively, the metadata endpoint can be disabled by overriding the route with a middleware that rejects all requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.9 >= 9.0.0, < 9.5.0 9.5.0 - 9.5.0 alpha1 9.5.0 alpha2 9.5.0 alpha3 9.5.0 alpha4 9.5.0 alpha5 9.5.0 alpha6 9.5.0 alpha7 9.5.0 alpha8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 7, 2026 | New CVE Received | [email protected] |