SB2026040768 - Improper access control in Parse Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026040768

SB2026040768 - Improper access control in Parse Server

Published: April 7, 2026

Security Bulletin ID SB2026040768
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper access control (CVE-ID: CVE-2026-30966)

The vulnerability allows a remote attacker to bypass access controls and gain unauthorized access to protected data and operations.

The vulnerability exists due to improper access control in internal relationship tables when handling direct REST API or GraphQL API operations using only the application key. A remote attacker can create, read, update, or delete records in `_Join` tables to bypass access controls and gain unauthorized access to protected data and operations.

Exploitation can allow injection into Parse Roles and can also bypass class-level permissions that rely on Relation fields used in `pointerFields` CLP.


Remediation

Install update from vendor's website.

References