Executive brief
Parse Server is an open-source backend used to build and host applications. A security flaw in its GraphQL interface allows any website to make requests to the server, bypassing security rules intended to restrict access to trusted domains only. This could allow malicious websites to interact with your application's data if a user visits them while authenticated to your service.
Technical details
A Cross-Origin Resource Sharing (CORS) policy bypass exists in Parse Server's GraphQL API. While the REST API correctly enforces the 'allowOrigin' configuration, the GraphQL endpoint ignores this setting and unconditionally accepts requests from any origin. This vulnerability (CWE-346) allows an attacker to perform cross-origin requests that should have been blocked by the server's security policy. Exploitation typically requires a victim to visit a malicious site while having an active session with the Parse Server. The issue is fixed in versions 8.6.66 and 9.7.0-alpha.10.
Affected products
- Parse Platform Parse Server >= 3.5.0, < 8.6.66; >= 9.0.0, < 9.7.0-alpha.10
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-27: patched
References
- https://github.com/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263
- https://github.com/parse-community/parse-server/commit/4dd0d3d8be1c39664c74ad10bb0abaa76bc41203
- https://github.com/parse-community/parse-server/pull/10334
- https://github.com/parse-community/parse-server/pull/10335
- https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c