1550 matches found
EUVD-2026-10882
Parse Server has role escalation and CLP bypass via direct Join table write...
Missing Authorization
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Missing Authorization via direct access to internal relationship tables through the REST API or GraphQL API using only the...
Parse Server has role escalation and CLP bypass via direct `_Join` table write
Impact Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required. An attacker can create, read, update, or delete records in any...
GHSA-5F92-JRQ3-28RC Parse Server has role escalation and CLP bypass via direct `_Join` table write
Impact Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required. An attacker can create, read, update, or delete records in any...
EUVD-2026-10883
Parse Server has role escalation and CLP bypass via direct Join table write...
Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
Impact A vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability...
GHSA-6R2J-CXGF-495F Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
Impact A vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability...
EUVD-2026-10880
Parse Server vulnerable to session token exfiltration via redirectClassNameForKey query parameter...
EUVD-2026-10881
Parse Server vulnerable to session token exfiltration via redirectClassNameForKey query parameter...
Incorrect Authorization
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization in the redirectClassNameForKey query parameter handling. An unauthenticated attacker can gain...
Incorrect Authorization
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization in the query validation. An authenticated user can access sensitive field values by wrapping...
EUVD-2026-10878
Parse Server has a protected fields bypass via logical query operators...
Parse Server has a protected fields bypass via logical query operators
Impact The validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values. All Parse Server...
GHSA-72HP-QFF8-4PVV Parse Server has a protected fields bypass via logical query operators
Impact The validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values. All Parse Server...
EUVD-2026-10879
Parse Server has a protected fields bypass via logical query operators...
EUVD-2026-10868
Parse Server missing audience validation in Keycloak authentication adapter...
EUVD-2026-10869
Parse Server missing audience validation in Keycloak authentication adapter...
Incorrect Authorization
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization in the Keycloak authentication adapter due to missing validation of the azp claim in access tokens...
GHSA-48MH-J4P5-7J9V Parse Server missing audience validation in Keycloak authentication adapter
Impact The Keycloak authentication adapter does not validate the azp authorized party claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse...