CVE-2026-121965

Parse Server prior to versions 8.6.67 and 9.7.0-alpha.11 has a vulnerability where an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. This causes all access control enforcement to be skipped, allowing unauthenticated callers to invoke protected Cloud Functions.

Parse Server prior to versions 8.6.3 and 9.1.1-alpha.4 is vulnerable to an attack where an unauthenticated attacker can forge a Google authentication token with 'alg: "none"', allowing them to log in as any user linked to a Google account without knowing their credentials.

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed in version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.

Parse Server prior to versions 5.5.2 and 6.2.1 is vulnerable to prototype pollution, which can lead to remote code execution through the MongoDB BSON parser.

Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression whose run time grows quadratically with input length and that is applied without a length limit. An unauthenticated attacker who knows the application ID can send a sign-up request, or a logged-in user can update their own email, with a long crafted email address to block the Node.js event loop and deny service to all clients.

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access. Clients whose class-level permissions or object ACLs allow update but not read can see object data, including atomic operation results, Cloud Code trigger-set values, and whole parent fields under dot notation in certain conditions.