Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.
References
Configurations
Configuration 1 (hide)
|
History
22 Dec 2025, 18:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/parse-community/parse-server/commit/6b9f8963cc3debf59cd9c5dfc5422aff9404ce9d - Patch | |
| References | () https://github.com/parse-community/parse-server/commit/e3d27fea08c8d8bdd9770a689bc2d757cda48b66 - Patch | |
| References | () https://github.com/parse-community/parse-server/security/advisories/GHSA-6w8g-mgvv-3fcj - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Parseplatform
Parseplatform parse-server |
|
| CPE | cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:8.6.0:alpha1:*:*:*:node.js:*:* |
12 Dec 2025, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-12 07:15
Updated : 2025-12-22 18:59
NVD link : CVE-2025-67727
Mitre link : CVE-2025-67727
CVE.ORG link : CVE-2025-67727
JSON object : View
Products Affected
parseplatform
- parse-server