Executive brief
Parse Server is a backend-as-a-service platform used to manage application data and configurations. Two internal system classes (_GraphQLConfig and _Audience) can be read, modified, and deleted without authentication through generic API routes, bypassing the security controls that normally require a master key. An attacker could alter GraphQL settings or push audience data without proper authorization, potentially compromising application functionality and data integrity.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the generic REST API routes /classes/_GraphQLConfig and /classes/_Audience. These routes lack the master key enforcement that exists on dedicated endpoints (/graphql-config and /push_audiences), allowing unauthenticated network access to read, modify, and delete internal configuration classes. The root cause is that _GraphQLConfig and _Audience were not included in the classesWithMasterOnlyAccess list. No authentication is required and the attack is network-reachable. The fix, released in Parse Server 8.6.25 and 9.5.2-alpha.12, adds these classes to the master-only access list to enforce consistent authorization.
Affected products
- Parse Community Parse Server All versions before 8.6.25; versions 9.0.0-alpha.1 before 9.5.2-alpha.12
Timeline
- 2026-03-11: disclosed: Advisory published
- 2026-03: patched: Fixed in Parse Server 8.6.25 and 9.5.2-alpha.12