PT-2026-24457 · Unknown · Parse Server

Restriction · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-30966

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.7 Parse Server versions prior to 8.6.20

Description Parse Server’s internal tables, which store Relation field mappings, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required. An attacker can create, read, update, or delete records in any internal relationship table. Exploiting this allows the attacker to inject themselves into any Parse Role, gaining all permissions associated with that role, including full read, write, and delete access to classes protected by role-based Class-Level Permissions (CLP). Writing to any such table that backs a Relation field used in pointerFields CLP bypasses that access control. The affected API endpoints are the REST API and GraphQL API. The vulnerable parameter is the application key.

Recommendations Update Parse Server to version 9.5.2-alpha.7 or later. Update Parse Server to version 8.6.20 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-PARSE-2026-30966

CVE-2026-30966

GHSA-5F92-JRQ3-28RC

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30966.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5f92-jrq3-28rc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5f92-jrq3-28rc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30966 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30966 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30966 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.20 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.7 · Note
• https://twitter.com/CveFindCom/status/2031485612147007928 · Twitter Post
• https://twitter.com/CVEnew/status/2031504115289747496 · Twitter Post