PT-2026-24460 · Unknown · Parse Server

Theinfosecguy · Published 2026-03-10 · Updated 2026-03-17 · CVE-2026-31800

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.12 Parse Server versions prior to 8.6.25

Description Parse Server, an open-source backend deployable on Node.js infrastructures, contains an issue where the internal GraphQLConfig and Audience classes are accessible, modifiable, and deletable through the /classes/ GraphQLConfig and /classes/ Audience REST API routes without requiring master key authentication. This circumvents the master key enforcement present in the dedicated /graphql-config and /push audiences API endpoints. An attacker could potentially read, modify, and delete GraphQL configuration and push audience data. The affected API endpoints are /classes/ GraphQLConfig and /classes/ Audience.

Recommendations Update to Parse Server version 9.5.2-alpha.12 or later. Update to Parse Server version 8.6.25 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-PARSE-2026-31800

CVE-2026-31800

GHSA-7XG7-RQF6-PW6C

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31800.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-31800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31800 · Security Note
• https://osv.dev/vulnerability/GHSA-7xg7-rqf6-pw6c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31800 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.25 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12 · Note
• https://twitter.com/WireReportOrg/status/2033755866818625648 · Twitter Post
• https://twitter.com/CVEnew/status/2031504091608748123 · Twitter Post