CVE-2026-31800

🗓️ 10 Mar 2026 20:51:14Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

Parse Server allows read modify delete of _GraphQLConfig and _Audience via generic class routes without master key.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-31800	10 Mar 202620:51	–	attackerkb
CNNVD	Parse Server 安全漏洞	10 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-31800 Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes	10 Mar 202620:51	–	cvelist
EUVD	EUVD-2026-10888	11 Mar 202600:23	–	euvd
EUVD	EUVD-2026-10889	11 Mar 202600:23	–	euvd
Github Security Blog	Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes	11 Mar 202600:23	–	github
NVD	CVE-2026-31800	10 Mar 202621:16	–	nvd
OSV	BIT-PARSE-2026-31800 Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes	12 Mar 202614:48	–	osv
OSV	CVE-2026-31800 Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes	10 Mar 202620:51	–	osv
OSV	GHSA-7XG7-RQF6-PW6C Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes	11 Mar 202600:23	–	osv

NVD

Vulners

Node

parseplatform parse-serverRange<8.6.25node.js

parseplatform parse-serverRange9.0.0–9.5.2node.js

parseplatform parse-serverMatch9.5.2alpha1node.js

parseplatform parse-serverMatch9.5.2alpha10node.js

parseplatform parse-serverMatch9.5.2alpha11node.js

parseplatform parse-serverMatch9.5.2alpha2node.js

parseplatform parse-serverMatch9.5.2alpha3node.js

parseplatform parse-serverMatch9.5.2alpha4node.js

parseplatform parse-serverMatch9.5.2alpha5node.js

parseplatform parse-serverMatch9.5.2alpha6node.js

parseplatform parse-serverMatch9.5.2alpha7node.js

parseplatform parse-serverMatch9.5.2alpha8node.js

parseplatform parse-serverMatch9.5.2alpha9node.js

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": ">= 9.0.0 < 9.5.2-alpha.12",
        "status": "affected"
      },
      {
        "version": "< 8.6.25",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c
github	www.github.com/parse-community/parse-server/releases/tag/8.6.25

Parameter	Position	Path	Description	CWE
read	path	/classes/_GraphQLConfig	Unauthorized access to GraphQL configuration via REST API routes bypassing master key enforcement.	CWE-862
modify	path	/classes/_GraphQLConfig	Unauthorized access to GraphQL configuration via REST API routes bypassing master key enforcement.	CWE-862
delete	path	/classes/_GraphQLConfig	Unauthorized access to GraphQL configuration via REST API routes bypassing master key enforcement.	CWE-862
read	path	/classes/_Audience	Unauthorized access to push audience data via REST API routes bypassing master key enforcement.	CWE-862
modify	path	/classes/_Audience	Unauthorized access to push audience data via REST API routes bypassing master key enforcement.	CWE-862
delete	path	/classes/_Audience	Unauthorized access to push audience data via REST API routes bypassing master key enforcement.	CWE-862

17 Jun 2026 10:34Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

CVSS 48.8

EPSS0.00335

SSVC

CWE-862