CVE-2026-50008 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the allow-list check. An external caller whose outer route matches batch can issue batch sub-requests to any REST API route that the operator omitted from the allow-list. Authentication, ACL, CLP, and other inner-route authorization controls still apply — only the operator-configured route firewall is bypassed. This issue has been patched in version 9.9.1-alpha.3.
A vulnerability exists in Parse Server versions 9.8.0 prior to 9.9.1-alpha.3, allowing the routeAllowList option to be bypassed through batch sub-requests. The routeAllowList is intended to restrict external client access to a specified list of REST API routes. However, the allow-list check is only applied to the outer HTTP request URL. This oversight enables an external caller to use the /batch handler to access any REST API route not included in the allow-list, as long as the outer route matches batch. While authentication and other authorization controls remain in effect, the bypassed route firewall can lead to unauthorized access on omitted routes.
Users can upgrade to Parse Server version 9.9.1-alpha.3, where this vulnerability has been patched. Alternatively, operators can manually include all inner routes they wish to allow via batch in the routeAllowList, but this method may expose those routes to direct REST requests as well.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/pull/10482 | [email protected] | Issue TrackingVendor |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-p84r-h6rx-f2xr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Parse Server | >= 9.8.0, < 9.9.1-alpha.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |