Vulnerability feed

Executive summary

A flaw in Parse Server, a backend framework, lets clients without the master key delete class schemas on MongoDB deployments. The advisory rates it High (CVSS v4 8.8) and says deleted schemas also remove class-level permissions and protected fields, which can expose or modify data.

Technical summary

This is a missing authorization flaw (CWE-862) in Parse Server on MongoDB deployments. A remote, unauthenticated client without the master key can delete the stored schema of any class through the REST API, removing field definitions, class-level permissions and protected fields; object ACLs still apply. The advisory lists affected versions as >= 9.0.0, < 9.10.4-alpha.4 and < 8.6.101, with patched versions 9.10.4-alpha.4 and 8.6.101. PostgreSQL deployments are stated to be unaffected. The vendor's workaround is to register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key. The advisory states that upgrading does not restore already deleted schemas, so administrators should review and restore permissions, protected fields and field definitions. No CVE ID is assigned in the advisory, and no detection guidance or known exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/parse-community/parse-server…/GHSA-qmg9-m772-5rm7

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

parse-communityParse Serverparse-community parse-serverParse Server parse-server

Executive summary

Parse Server, a Node.js backend framework, has a flaw that lets clients write objects with reserved internal field names. On MongoDB deployments this can make reads of affected objects fail for all users of that class, and any user can clear internal account lockout or password history fields on their own account. The advisory rates the issue Moderate and recommends upgrading to Parse Server 8.6.100 or 9.10.4-alpha.3, or applying a beforeSave Cloud Code trigger workaround.

Technical summary

The weakness is CWE-20, Improper Input Validation, where Parse Server does not reject reserved internal field names in client object writes. The attack is network based with low complexity and requires no privileges or user interaction, but the attacker must be allowed to create objects in a class, and the advisory notes the MongoDB-specific read failure. Affected versions are stated as >= 9.0.0 and < 9.10.4-alpha.3, and < 8.6.100, with patched versions 9.10.4-alpha.3 and 8.6.100. The documented workaround is registering a beforeSave Cloud Code trigger for every writable class, including _User, which discards reserved field names; existing bad fields must be removed directly in MongoDB. The advisory does not state any detection guidance, and it does not state whether the issue is exploited in the wild. CVSS v4 base score is shown as 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. No CVE ID is assigned in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/parse-community/parse-server…/GHSA-gwrq-q25v-g8mr

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

Present

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

parse-communityParse Serverparse-community parse-serverParse Server parse-server

Executive summary

A flaw in Parse Server, a server framework for building app backends, lets attackers bypass authentication when an app uses a custom authentication adapter built as a subclass of AuthAdapter. The advisory rates it Critical with a CVSS 9.1 score and says the fix is to upgrade to Parse Server 8.6.102 or 9.10.5-alpha.2, or to rework custom adapters as described in the workarounds.

Technical summary

The weakness is classified as CWE-287, Improper Authentication. Custom adapters that extend AuthAdapter never had their validateSetUp, validateLogin, and validateUpdate methods called, so the inherited default accepting any authData was used instead. The advisory states the attack is network-based with low complexity and no privileges or user interaction required, and that an attacker can sign up, link an identity, or log in as an existing user without valid credentials. Affected versions are stated as 9.0.0 up to but not including 9.10.5-alpha.2, and versions before 8.6.102; patched versions are 9.10.5-alpha.2 and 8.6.102. Workarounds are to implement all validation in an overridden validateAuthData method that does not rely on adapter instance state, or to define the adapter as a plain object. The advisory does not state any detection guidance or indicators of exploitation in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/parse-community/parse-server…/GHSA-rq3w-5c6f-p7wr

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

Present

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

parse-communityParse Serverparse-community parse-serverParse Server parse-server

Executive summary

Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 let a user with SMS multi-factor authentication enabled change restricted fields on their own account. The advisory rates the severity as Low, with a CVSS v4 score of 2.1.

Technical summary

The flaw is classified as CWE-269, Improper Privilege Management. When requesting an SMS MFA login verification code, Parse Server saved the entire login request with master privileges, so extra account fields in that request were persisted, bypassing write restrictions such as beforeSave triggers. Exploitation requires an account enrolled in SMS MFA and high privileges as listed in the CVSS vector, and it is limited to the requester's own account. Affected versions are stated as greater than or equal to 9.0.0 and less than 9.10.5-alpha.5, and less than 8.6.104; patched versions are 9.10.5-alpha.5 and 8.6.104. The advisory states there is no configuration workaround and recommends upgrading. No detection guidance is stated, and exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/parse-community/parse-server…/GHSA-9rh6-r4ph-367v

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

Present

Privileges required

High

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

parse-communityParse Serverparse-community parse-serverParse Server parse-server

Executive summary

Parse Server, a Node.js backend package, has an information disclosure flaw in its LiveQuery feature. Subscriptions that use a $or query can receive another user's events, including session tokens, which could let an attacker act as another user. The advisory rates it Moderate and recommends upgrading to a patched version (9.10.5-alpha.4 or 8.6.103).

Technical summary

The flaw is CWE-200 (exposure of sensitive information to an unauthorized actor) in Parse Server's LiveQuery. The subscription hash omits query constraints placed next to a $or operator, including the server-added _Session owner filter and constraints added by beforeSubscribe triggers, so different clients can be grouped into one subscription and receive each other's events. The advisory lists network attack vector, low attack complexity, low privileges required, no user interaction, and a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, with an overall score of 6.0. Affected versions are >= 9.0.0 and < 9.10.5-alpha.4, and <= 8.6.102; patched versions are 9.10.5-alpha.4 and 8.6.103. Workarounds are to protect sensitive classes with ACL or class-level permissions, avoid $or in _Session subscriptions, and avoid $or where isolation depends on constraints beside it. The advisory does not state any detection guidance, and it lists no CVE ID.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/parse-community/parse-server…/GHSA-349r-988w-x3jp

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

Present

Privileges required

Low

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

parse-communityParse Serverparse-community parse-serverParse Server parse-server