CVE-2026-105828

Parse Server prior to versions 8.6.67 and 9.7.0-alpha.11 has a vulnerability where an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. This causes all access control enforcement to be skipped, allowing unauthenticated callers to invoke protected Cloud Functions.

Parse Server prior to versions 8.6.3 and 9.1.1-alpha.4 is vulnerable to an attack where an unauthenticated attacker can forge a Google authentication token with 'alg: "none"', allowing them to log in as any user linked to a Google account without knowing their credentials.

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed in version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.

Parse Server prior to versions 5.5.2 and 6.2.1 is vulnerable to prototype pollution, which can lead to remote code execution through the MongoDB BSON parser.

Parse Server versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91 do not verify the client's authorization code with the external provider on the login endpoint when authentication data is supplied with a username and password. This allows a low-privileged authenticated user to attach an arbitrary, unverified provider identity to their own account, and also enables account pre-hijacking. Fixed in versions 9.10.1-alpha.10 and 8.6.91.

Parse Server versions >= 9.0.0 and < 9.10.1-alpha.8, and versions < 8.6.89, evaluate the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. Fixed in 9.10.1-alpha.8 and 8.6.89.

Parse Server, an open source backend server, in versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9, has a vulnerability in the device token deduplication logic for installation records. The logic does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values to inject query operators, causing the deduplication cleanup to delete every device registration in the application or an attacker-chosen subset.

Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwards the client-supplied password without verifying it is provided and treats any non-error response as proof of authentication. An unauthenticated attacker knowing a directory username can obtain a valid session token for that account, leading to account takeover.

Parse Server versions from 9.0.0 before 9.10.0-alpha.5 and from 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application ID, with no user session, master key, or maintenance key, can trigger validation errors to learn the names of required custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.

Parse Server versions from 9.0.0 before 9.10.0-alpha.6 and from 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.