CVE-2026-30965 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability requires the attacker to be able to create or update an object with a new relation field, which depends on the Class-Level Permissions of at least one class. This vulnerability is fixed in 9.5.2-alpha.8 and 8.6.21.
A vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. This issue is present in Parse Server versions 9.0.0 prior to 9.5.2-alpha.8 and versions prior to 8.6.21. The exfiltrated session tokens can be used to take over user accounts. The vulnerability arises when an attacker can create or update an object with a new relation field, depending on the Class-Level Permissions of at least one class.
Users can update to Parse Server versions 9.5.2-alpha.8 or 8.6.21, where this vulnerability has been patched. Additionally, as a workaround, restrictive Class-Level Permissions can be set to prevent clients from creating new fields on classes, specifically by disabling 'addField' for public access and unauthenticated users.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.21 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.8 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.21 >= 9.0.0, < 9.5.2 9.5.2 alpha1 9.5.2 alpha2 9.5.2 alpha3 9.5.2 alpha4 9.5.2 alpha5 9.5.2 alpha6 9.5.2 alpha7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |