Incorrect authorization in Parse Server - CVE-2026-30228
Published: April 6, 2026
Vulnerability identifier: #VU124969
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-30228
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify files.
The vulnerability exists due to incorrect authorization in the Files API when handling file creation and deletion requests with the readOnlyMasterKey. A remote privileged user can send crafted POST or DELETE requests to modify files.
Only deployments that use readOnlyMasterKey and expose the Files API are vulnerable.
Affected software
Parse Server
How to mitigate CVE-2026-30228
Install security update from vendor's website.
Parse Server - addressed in versions 8.6.5, 9.5.0 alpha.3