CVE-2026-30850

Published: Mar 7, 2026Modified: Jun 17, 2026

6.3

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata. This issue has been patched in versions 8.6.9 and 9.5.0-alpha.9.

Affected (11)

Products: Parseplatform: Parse Server

Parseplatform

1 product

Parse Server

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Parseplatform Parse Server	Before 8.6.9
Parseplatform Parse Server	From 9.0.0 to 9.5.0
Parseplatform Parse Server	Version 9.5.0
Parseplatform Parse Server	Version 9.5.0 alpha1
Parseplatform Parse Server	Version 9.5.0 alpha2
Parseplatform Parse Server	Version 9.5.0 alpha3
Parseplatform Parse Server	Version 9.5.0 alpha4
Parseplatform Parse Server	Version 9.5.0 alpha5
Parseplatform Parse Server	Version 9.5.0 alpha6
Parseplatform Parse Server	Version 9.5.0 alpha7
Parseplatform Parse Server	Version 9.5.0 alpha8

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.