#VU124969 Incorrect authorization in Parse Server - CVE-2026-30228
Published: April 6, 2026
Vulnerability identifier: #VU124969
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-30228
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Parse Server
Parse Server
Software vendor:
Parse Community
Parse Community
Description
The vulnerability allows a remote user to modify files.
The vulnerability exists due to incorrect authorization in the Files API when handling file creation and deletion requests with the readOnlyMasterKey. A remote privileged user can send crafted POST or DELETE requests to modify files.
Only deployments that use readOnlyMasterKey and expose the Files API are vulnerable.
Remediation
Install security update from vendor's website.