PT-2026-24456 · Unknown · Parse Server

Theinfosecguy · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-30965

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.8 Parse Server versions prior to 8.6.21

Description Parse Server, an open-source backend deployable on Node.js infrastructures, contains an issue in its query handling. An attacker, authenticated or unauthenticated, can potentially obtain session tokens belonging to other users by manipulating the redirectClassNameForKey query parameter. Successful exploitation requires the attacker's ability to create or update an object with a new relation field, dependent on the Class-Level Permissions of at least one class. Compromised session tokens could allow for account takeover.

Recommendations Update Parse Server to version 9.5.2-alpha.8 or later. Update Parse Server to version 8.6.21 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-PARSE-2026-30965

CVE-2026-30965

GHSA-6R2J-CXGF-495F

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30965.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6r2j-cxgf-495f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30965 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30965 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30965 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.8 · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.21 · Note
• https://twitter.com/CVEnew/status/2031504116325756947 · Twitter Post