Is CVE-2026-39381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39381 being exploited in the wild.

How severe is CVE-2026-39381?

Medium severity, with a CVSS score of 4.3, published 7 April 2026.

Which products and versions are affected?

parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.8.0-alpha.7.

Is there a fix for CVE-2026-39381?

Yes. parse-server (npm): upgrade to 9.8.0-alpha.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39381 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39381?

Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39381: Parse Community Parse Server information exposure in sessions/me endpoint

CVE-2026-39381 · Severity: medium · CVSS 4.3 · Published 2026-04-07

Parse Server is an open-source backend framework used to build and host applications. A security flaw in the session management component allows logged-in users to view sensitive internal data fields that administrators have specifically marked as protected. While this does not allow users to access other people's data, it exposes internal session details that should remain hidden according to the server's security configuration.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-39381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39381 being exploited in the wild.
How severe is CVE-2026-39381?: Medium severity, with a CVSS score of 4.3, published 7 April 2026.
Which products and versions are affected?: parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.8.0-alpha.7.
Is there a fix for CVE-2026-39381?: Yes. parse-server (npm): upgrade to 9.8.0-alpha.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39381 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39381?: Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-server (npm): upgrade to 9.8.0-alpha.7 or later
```
npm install parse-server@9.8.0-alpha.7
```

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Parse Server's SessionsRouter. The 'GET /sessions/me' endpoint fails to apply the 'protectedFields' server configuration, which is intended to sanitize sensitive fields from API responses. While the '/sessions' and '/sessions/:objectId' endpoints correctly strip these fields, the '/sessions/me' handler initially lacked the logic to re-fetch the session using the caller's specific auth context to enforce field-level restrictions. An authenticated attacker can exploit this to retrieve sensitive session metadata (e.g., 'createdWith') that should be restricted. The fix implements a two-step lookup in the 'handleMe' function to ensure 'protectedFields' and Class Level Permissions (CLP) are applied.

Affected products

Parse Community Parse Server >= 9.0.0, < 9.8.0-alpha.7; >= 7.0.0, < 8.6.75

Identifiers

CVE-2026-39381
GHSA-g4v2-qx3q-4p64

Timeline

2026-04-06: patched: Fixes merged in PR #10406 and #10407
2026-04-06: advisory: GitHub Security Advisory GHSA-g4v2-qx3q-4p64 published
2026-04-07: disclosed: CVE-2026-39381 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.