PT-2026-23752 · Parse · Parse Server

Devanshbatham · Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-30228

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.5 Parse Server versions prior to 9.5.0-alpha.3

Description The readOnlyMasterKey can be misused to create and delete files through the Files API. Specifically, the API endpoints /files/:filename (POST and DELETE methods) are affected. This bypasses the intended read-only restriction associated with the readOnlyMasterKey, allowing unauthorized file manipulation. An attacker possessing the readOnlyMasterKey can upload arbitrary files or delete existing ones. Any Parse Server deployment utilizing the readOnlyMasterKey and exposing the Files API is susceptible to this issue.

Recommendations Versions prior to 8.6.5 should be updated to version 8.6.5 or later. Versions prior to 9.5.0-alpha.3 should be updated to version 9.5.0-alpha.3 or later. As a workaround, restrict network access to the /files/:filename API endpoints. Alternatively, avoid using the readOnlyMasterKey.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-PARSE-2026-30228

CVE-2026-30228

GHSA-XFH7-PHR7-GR2X

Affected Products

Parse Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30228.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xfh7-phr7-gr2x · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30228 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xfh7-phr7-gr2x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30228 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.5 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.3 · Note
• https://t.me/CVEtracker/46650 · Telegram Post
• https://twitter.com/CVEnew/status/2030385166951055683 · Twitter Post
• https://twitter.com/0xAsm0d3us/status/2030292792422088932 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030127321970040925 · Twitter Post
• https://t.me/cveNotify/155076 · Telegram Post