Improper access control in Parse Server - CVE-2026-30966
Published: April 6, 2026
Vulnerability identifier: #VU124987
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-30966
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass access controls and gain unauthorized access to protected data and operations.
The vulnerability exists due to improper access control in internal relationship tables when handling direct REST API or GraphQL API operations using only the application key. A remote attacker can create, read, update, or delete records in `_Join` tables to bypass access controls and gain unauthorized access to protected data and operations.
Exploitation can allow injection into Parse Roles and can also bypass class-level permissions that rely on Relation fields used in `pointerFields` CLP.
Affected software
Parse Server
How to mitigate CVE-2026-30966
Install security update from vendor's website.
Parse Server - addressed in versions 8.6.20, 9.5.2 alpha.7