Executive brief
Parse Server is an open-source backend framework that manages data, files, and user authentication for applications. The file metadata endpoint fails to enforce access-control triggers, allowing attackers to view file metadata (user-defined tags and properties) that should be restricted. While file content itself remains protected, unauthorized access to metadata could expose sensitive information about stored files and user activity.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the file metadata endpoint (GET /files/:appId/metadata/:filename) that does not invoke beforeFind and afterFind trigger hooks. These hooks are intended to enforce access-control policies on file queries. An unauthenticated or unprivileged attacker can access the metadata endpoint over the network without authentication to retrieve file metadata (user-defined key-value pairs) that should be gated by triggers. File content itself is not exposed. The issue affects all versions prior to 8.6.9 and versions 9.0.0-alpha.1 through 9.5.0-alpha.8. Patches are available in 8.6.9 and 9.5.0-alpha.9.
Affected products
- Parse Community Parse Server <8.6.9, >=9.0.0-alpha.1 <9.5.0-alpha.9
Timeline
- 2026-03-09: disclosed: GitHub security advisory published
- 2026-03-07: advisory: NVD published
- 2026-03-09: patched: Parse Server 8.6.9 and 9.5.0-alpha.9 released with fix