Executive brief
Parse Server is a backend framework that manages data and APIs for applications. An attacker can execute database explain queries without authentication to view detailed schema information, index configurations, and query performance metrics. This allows reconnaissance of the database structure without requiring any credentials or master key.
Technical details
Parse Server fails to enforce authentication on MongoDB explain() queries, allowing unauthenticated clients to execute them. The vulnerability stems from missing access control on the explain query endpoint. An attacker can send network requests to execute explain queries without providing the master key, exposing database schema structure, field names, index configurations, and query optimization details. The fix introduces a databaseOptions.allowPublicExplain configuration option (defaulting to true for backward compatibility) to restrict explain queries to authenticated requests. Patches are available starting in version 8.5.0-alpha.5.
Affected products
- Parse Community Parse Server <8.5.0-alpha.5
Timeline
- 2025-11-13: disclosed
- 2025-11-13: patched: Patch released in version 8.5.0-alpha.5