PT-2026-23873 · Unknown · Parse Server

Fancymalware · Published 2026-03-07 · Updated 2026-03-11 · CVE-2026-30850

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.9 Parse Server versions prior to 9.5.0-alpha.9

Description Parse Server, an open source backend deployable on Node.js infrastructures, has an issue where the file metadata endpoint does not enforce beforeFind and afterFind file triggers for versions prior to 8.6.9 and 9.5.0-alpha.9. When these triggers are used for access control, the metadata endpoint bypasses them, potentially allowing unauthorized access to file metadata. The vulnerable API endpoint is /files/:appId/metadata/:filename.

Recommendations Update to Parse Server version 8.6.9 or later. Update to Parse Server version 9.5.0-alpha.9 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-PARSE-2026-30850

CVE-2026-30850

GHSA-HWX8-Q9CG-MQMC

Affected Products

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30850.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30850 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-30850 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hwx8-q9cg-mqmc · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2030339281873678502 · Twitter Post
• https://t.me/cveNotify/154933 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2030406390141886770 · Twitter Post
• https://twitter.com/dailycve/status/2031116642629877883 · Twitter Post
• https://t.me/CVEtracker/46740 · Telegram Post