CVE-2026-30966 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required. An attacker can create, read, update, or delete records in any internal relationship table. Exploiting this allows the attacker to inject themselves into any Parse Role, gaining all permissions associated with that role, including full read, write, and delete access to classes protected by role-based Class-Level Permissions (CLP). Similarly, writing to any such table that backs a Relation field used in a pointerFields CLP bypasses that access control. This vulnerability is fixed in 9.5.2-alpha.7 and 8.6.20.
A vulnerability in Parse Server has been identified, allowing direct access to internal tables that manage Relation field mappings, such as role memberships. This issue affects Parse Server versions 9.0.0 prior to 9.5.2-alpha.7 and versions prior to 8.6.20. The vulnerability can be exploited through the REST API or GraphQL API by any client using only the application key, without the need for a master key. An attacker can create, read, update, or delete records in any internal relationship table. This exploitation enables the attacker to inject themselves into any Parse Role, acquiring all associated permissions, including full read, write, and delete access to classes protected by role-based Class-Level Permissions (CLP). Additionally, writing to any table that supports a Relation field used in a 'pointerFields' CLP can bypass that access control.
Users can upgrade to Parse Server versions 9.5.2-alpha.7 or 8.6.20 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.20 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.7 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-5f92-jrq3-28rc | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.20 >= 9.0.0, < 9.5.2 9.5.2 alpha1 9.5.2 alpha2 9.5.2 alpha3 9.5.2 alpha4 9.5.2 alpha5 9.5.2 alpha6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |