Executive brief
Parse Server is a backend framework that provides database and API services for applications. An unauthenticated attacker can directly access Parse Server's internal relationship tables (which store role memberships and relation field mappings) using only the public application key, without needing the master key. By writing malicious data to these internal tables, attackers can inject themselves into any user role to gain full administrative permissions, or bypass access controls protecting sensitive data, leading to complete compromise of data confidentiality and integrity.
Technical details
This is an improper access control vulnerability (CWE-284) in Parse Server's REST and GraphQL APIs. The root cause is the lack of security enforcement on internal `_Join` tables that back Parse Role memberships and Relation fields. Any unauthenticated or low-privilege client can perform all CRUD operations on these internal tables using only the application key. An attacker can directly inject themselves into Parse Roles by writing to the appropriate internal table, thereby gaining all role-based permissions including read, write, and delete access to classes protected by role-based Class-Level Permissions (CLP). Similarly, an attacker can modify Relation field data to bypass pointer-based CLP rules. The vulnerability requires network access (the APIs are network-exposed) but no authentication credentials beyond the public application key. Patches are available in Parse Server 8.6.20 and 9.5.2-alpha.7 or later, which enforce master key or maintenance key requirements for all operations on internal relationship tables.
Affected products
- Parse Community Parse Server All versions prior to 8.6.20; versions 9.0.0-alpha.1 and later prior to 9.5.2-alpha.7
Timeline
- 2026-03-10: disclosed: Public disclosure via GitHub security advisory
- 2026-03-08: patched: Parse Server 8.6.20 released with fix
- 2026-03-08: patched: Parse Server 9.5.2-alpha.7 released with fix