Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration

Parse Server 8.6.21 / 9.x 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a...

POC_SQL_injection_in_Parse_Server_prior_6.5.7_-_7.1.0

Database Ghost 🔥 Advanced PostgreSQL SQL Injection Exploitation Tool 🚨 DISCLAIMER FOR AUTHORIZED SECURITY TESTING ONLY Unauthorized use is illegal. Use only on systems you own or have explicit permission to test. ⚡ QUICK START Install & Run git clone...

BIT-PARSE-2026-110854 Parse Server before 8.6.97 and 9.10.2 Denial of Service via Unhandled Email Error

Parse Server before 8.6.97 and 9.0.0 before 9.10.2 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while...

CVE-2026-112768

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112769

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...

CVE-2026-112769 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...

EUVD-2026-104575

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...

CVE-2026-112769

Parse Server versions prior to 8.6.98 and 9.0.0 before 9.10.3-alpha.1 are vulnerable to a Session Class-Level Permission Bypass . The application fails to enforce create and addField class-level permissions for the _Session class. Consequently, an authenticated user, or an attacker possessing the...

CVE-2026-112769 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to...

CVE-2026-112768

Parse Server versions prior to 8.6.99 and 9.0.0 before 9.10.3-alpha.2 are vulnerable to an Information Disclosure vulnerability. The root cause is that the system evaluates checks against a target account during a user update before authorizing the caller, reflecting the outcome in the response. ...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

EUVD-2026-104574

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

BIT-PARSE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1 protectedFields Bypass via Relation Count Query

Parse Server before 8.6.93 and 9.0.0 before 9.10.1 does not enforce identity-scoped protectedFields authenticated, role, or per-user groups on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can...

BIT-PARSE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and...

BIT-PARSE-2026-109301 Parse Server before 8.6.95 and 9.0.0 before 9.10.2 Denial of Service via File Pointer Without URL

Parse Server before 8.6.95 and 9.0.0 before 9.10.2 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete trigge...

gha-lab-51c6b6d0a0

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of parse-community/parse-server at commit...

PT-2026-115927

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted...

CVE-2022-24760

CVE-2022-24760 flow By default, no key is required to add, delete, or modify classes in the database Diff commit https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d Prototype pollution occurs in the function expandResultOnKeyPath DatabaseController.js...

EUVD-2026-101737

Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password rese...