Executive brief
Parse Server is an open-source backend used to build and host applications. A security flaw allows unauthorized users to download protected files by using specific web requests that bypass security checks. This could lead to the exposure of sensitive user data or private documents that were intended to be restricted.
Technical details
An authorization bypass vulnerability exists in Parse Server's handling of HTTP Range requests. When using storage adapters that support streaming (such as the default GridFS adapter), ranged requests fail to invoke the 'afterFind(Parse.File)' trigger and its associated validators. This allows remote attackers to bypass security logic like 'requireUser' or custom authorization triggers to access restricted files. The vulnerability is exploited via specially crafted HTTP Range headers during file download requests. Patches are available in versions 8.6.71 and 9.7.1-alpha.1.
Affected products
- Parse Platform Parse Server < 8.6.71, >= 9.0.0 < 9.7.1-alpha.1
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched
References
- https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337
- https://github.com/parse-community/parse-server/commit/a0b0c69fc44f87f80d793d257344e7dcbf676e22
- https://github.com/parse-community/parse-server/pull/10361
- https://github.com/parse-community/parse-server/pull/10362
- https://github.com/parse-community/parse-server/security/advisories/GHSA-hpm8-9qx6-jvwv