Executive brief
Parse Server is a backend framework that manages files, data, and user accounts. A flaw in its file handling allows attackers who possess the read-only master key to create and delete files, which should not be permitted. This violates the intended access restrictions and could allow attackers to upload malicious files or delete critical data.
Technical details
The vulnerability is an authorization bypass (CWE-863) in Parse Server's file API endpoints (POST and DELETE /files/:filename). The readOnlyMasterKey, which is intended to restrict write operations, fails to properly enforce permission checks on file creation and deletion handlers. An attacker with access to the readOnlyMasterKey can bypass these restrictions via network requests. The fix adds permission validation to both file upload and delete operations. Patches are available in versions 8.6.5 and 9.5.0-alpha.3 or later.
Affected products
- Parse Community Parse Server all versions before 8.6.5; 9.0.0 to before 9.5.0-alpha.3
Timeline
- 2026-03-06: disclosed
- 2026-03-06: patched: Parse Server 8.6.5 and 9.5.0-alpha.3