PT-2026-24187 · Unknown · Parse Server

0Xkakash1 · Published 2026-03-10 · Updated 2026-03-18 · CVE-2026-30938

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.12 Parse Server versions prior to 9.5.1-alpha.1

Description A logic flaw in the requestKeywordDenylist security control allows bypassing restrictions by placing nested objects or arrays before prohibited keywords in the request payload. The issue stems from a bug that halts scanning of sibling keys after encountering the first nested value, impacting both default and custom requestKeywordDenylist entries. This affects all Parse Server deployments where the requestKeywordDenylist is enabled. The fix involves replacing the recursive object scanner with an iterative stack-based traversal to process all nested values without prematurely exiting the scan loop.

Recommendations Versions prior to 8.6.12: Update to version 8.6.12 or later. Versions prior to 9.5.1-alpha.1: Update to version 9.5.1-alpha.1 or later. Use a Cloud Code beforeSave trigger to validate incoming data for prohibited keywords across all classes.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BIT-PARSE-2026-30938

CVE-2026-30938

GHSA-Q342-9W2P-57FP

Affected Products

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30938.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30938 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30938 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q342-9w2p-57fp · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.12 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.1 · Note
• https://t.me/cveNotify/155166 · Telegram Post
• https://twitter.com/infoflowcloud/status/2034138095595971033 · Twitter Post
• https://twitter.com/CVEnew/status/2034136486392594553 · Twitter Post