CVE-2026-39381
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Parse Server is vulnerable to disclosure of protected session fields via the GET /sessions/me endpoint. This endpoint returns _Session fields that the server operator configured as protected, while other endpoints correctly strip them.
Risk Assessment
Any authenticated user can read the protected fields of their own session, potentially compromising the confidentiality of data configured as protected.
Recommendation
Update Parse Server to version 9.8.0-alpha.7 or 8.6.75 (depending on the branch used).
Original NVD description (English source)
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields. This vulnerability is fixed in 9.8.0-alpha.7 and 8.6.75.