Incorrect authorization in Parse Server - CVE-2026-30965
Published: April 6, 2026
Vulnerability identifier: #VU124986
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-30965
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose session tokens of other users and take over user accounts.
The vulnerability exists due to incorrect authorization in Parse Server query handling for the redirectClassNameForKey query parameter when processing redirected queries. A remote attacker can create or update an object with a new relation field to disclose session tokens of other users and take over user accounts.
Exploitation requires the ability to create or update an object with a new relation field, depending on the class-level permissions of at least one class.
Affected software
Parse Server
How to mitigate CVE-2026-30965
Install security update from vendor's website.
Parse Server - addressed in versions 8.6.21, 9.5.2 alpha.8