PT-2026-24455 · Unknown · Parse Server

0Xkakash1 · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-30962

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.6 Parse Server versions prior to 8.6.19

Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its validation process for protected fields. The validation only examines top-level query keys, allowing authenticated users to bypass the protection by embedding query constraints on protected fields within logical operators. This enables unauthorized access and extraction of values from protected fields, as default protected fields exist in all Parse Server deployments.

Recommendations Update to Parse Server version 9.5.2-alpha.6 or later. Update to Parse Server version 8.6.19 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-PARSE-2026-30962

CVE-2026-30962

GHSA-72HP-QFF8-4PVV

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30962.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30962 · Security Note
• https://osv.dev/vulnerability/GHSA-72hp-qff8-4pvv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30962 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.19 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.6 · Note
• https://twitter.com/CVEnew/status/2031504117382762819 · Twitter Post