PT-2025-50894 · Unknown · Parse Server

Barakharyati · Published 2025-12-12 · Updated 2025-12-12 · CVE-2025-67727

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.0-alpha.2

Description Parse Server is an open source backend deployable on Node.js infrastructures. A GitHub CI workflow can be triggered in a manner that grants elevated permissions to the GitHub Actions workflow, providing access to GitHub secrets and write permissions defined within the workflow. Code originating from a fork or lifecycle scripts may be included. The affected area is limited to the repository's CI/CD infrastructure, including public GitHub forks with GitHub Actions enabled.

Recommendations Update Parse Server to version 8.6.0-alpha.2 or later.

Exploit

Fix

RCE

Improper Privilege Management

Code Injection

Weakness Enumeration

CWE-269

CWE-94

Related Identifiers

BIT-PARSE-2025-67727

CVE-2025-67727

GHSA-6W8G-MGVV-3FCJ

Affected Products

Parse Server

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67727.json · Exploit
• https://github.com/parse-community/parse-server/commit/e3d27fea08c8d8bdd9770a689bc2d757cda48b66 · Patch
• https://github.com/parse-community/parse-server/commit/6b9f8963cc3debf59cd9c5dfc5422aff9404ce9d · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6w8g-mgvv-3fcj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67727 · Security Note
• https://t.me/CVEtracker/39591 · Telegram Post
• https://t.me/cveNotify/145564 · Telegram Post