Improper access control in Parse Server - CVE-2025-64502
Published: April 6, 2026
Vulnerability identifier: #VU124966
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-64502
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in explain query handling when processing public explain queries. A remote attacker can send explain queries without the master key to disclose sensitive information.
The issue may expose database schema structure, field names, index configurations, query optimization details, and query execution statistics.
Affected software
Parse Server
How to mitigate CVE-2025-64502
Install security update from vendor's website.
Parse Server - update to 8.5.0 alpha.5