CVE-2026-39381

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-39381
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields. This vulnerability is fixed in 9.8.0-alpha.7 and 8.6.75.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/pull/10406 Issue Tracking Patch
https://github.com/parse-community/parse-server/pull/10407 Issue Tracking Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha2:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha3:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha4:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha5:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha6:*:*:*:node.js:*:*
History

15 Apr 2026, 15:57

Type Values Removed Values Added
References () https://github.com/parse-community/parse-server/pull/10406 - () https://github.com/parse-community/parse-server/pull/10406 - Issue Tracking, Patch
References () https://github.com/parse-community/parse-server/pull/10407 - () https://github.com/parse-community/parse-server/pull/10407 - Issue Tracking, Patch
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64 - () https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64 - Patch, Vendor Advisory
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha6:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha4:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha5:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha3:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.8.0:alpha2:*:*:*:node.js:*:*
First Time Parseplatform
Parseplatform parse-server
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3

07 Apr 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-07 20:16

Updated : 2026-04-15 15:57

NVD link : CVE-2026-39381

Mitre link : CVE-2026-39381

CVE.ORG link : CVE-2026-39381

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-863

Incorrect Authorization