CVE-2026-121413

The Parse Server software is affected by an authorization bypass in the session upgrade endpoint, impacting versions prior to 8.6.112 and 9.0.0 before 9.10.6-alpha.4 . The root cause is the failure to enforce the _Session class create class-level permission when creating new sessions for valid se...