PT-2026-23753 · Unknown · Parse Server

Devanshbatham · Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-30229

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.6 Parse Server versions prior to 9.5.0-alpha.4

Description Parse Server is an open-source backend deployable on Node.js infrastructures. A read-only master key can be used to call the POST /loginAs API endpoint, allowing the creation of a valid session token for any user. This enables a read-only credential to impersonate any user, gaining full read and write access to their data. Any Parse Server deployment utilizing the readOnlyMasterKey is potentially affected. The fix involves adding a check to the /logInAs handler.

Recommendations Versions prior to 8.6.6 should be updated to version 8.6.6 or later. Versions prior to 9.5.0-alpha.4 should be updated to version 9.5.0-alpha.4 or later. As a workaround, avoid using the readOnlyMasterKey.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-PARSE-2026-30229

CVE-2026-30229

GHSA-79WJ-8RQV-JVP5

Affected Products

Parse Server

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30229.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-79wj-8rqv-jvp5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30229 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-30229 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79wj-8rqv-jvp5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30229 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.6 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.4 · Note
• https://twitter.com/CVEnew/status/2030385165994733691 · Twitter Post
• https://t.me/CVEtracker/46651 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2030124762437935273 · Twitter Post
• https://t.me/cveNotify/155077 · Telegram Post
• https://twitter.com/0xAsm0d3us/status/2030290623484264828 · Twitter Post