CVE-2026-30228

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30228
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey. Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files. This issue has been patched in versions 8.6.5 and 9.5.0-alpha.3.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/releases/tag/8.6.5 Release Notes Product
https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.3 Release Notes Product
https://github.com/parse-community/parse-server/security/advisories/GHSA-xfh7-phr7-gr2x Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*
History

11 Mar 2026, 12:33

Type Values Removed Values Added
Summary
  • (es) Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.5 y 9.5.0-alpha.3, la readOnlyMasterKey puede ser utilizada para crear y eliminar archivos a través de la API de Archivos (POST /files/:filename, DELETE /files/:filename). Esto elude la restricción de solo lectura, lo cual viola el alcance de acceso de la readOnlyMasterKey. Cualquier despliegue de Parse Server que utilice readOnlyMasterKey y exponga la API de Archivos se ve afectado. Un atacante con acceso a la readOnlyMasterKey puede cargar archivos arbitrarios o eliminar archivos existentes. Este problema ha sido parcheado en las versiones 8.6.5 y 9.5.0-alpha.3.
References () https://github.com/parse-community/parse-server/releases/tag/8.6.5 - () https://github.com/parse-community/parse-server/releases/tag/8.6.5 - Release Notes, Product
References () https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.3 - () https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.3 - Release Notes, Product
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-xfh7-phr7-gr2x - () https://github.com/parse-community/parse-server/security/advisories/GHSA-xfh7-phr7-gr2x - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*
First Time Parseplatform
Parseplatform parse-server

06 Mar 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-06 21:16

Updated : 2026-03-11 12:33

NVD link : CVE-2026-30228

Mitre link : CVE-2026-30228

CVE.ORG link : CVE-2026-30228

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-863

Incorrect Authorization