Executive brief
Parse Server is an open-source backend framework used to build and host applications. A security flaw in the session management component allows logged-in users to view sensitive internal data fields that administrators have specifically marked as protected. While this does not allow users to access other people's data, it exposes internal session details that should remain hidden according to the server's security configuration.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Parse Server's SessionsRouter. The 'GET /sessions/me' endpoint fails to apply the 'protectedFields' server configuration, which is intended to sanitize sensitive fields from API responses. While the '/sessions' and '/sessions/:objectId' endpoints correctly strip these fields, the '/sessions/me' handler initially lacked the logic to re-fetch the session using the caller's specific auth context to enforce field-level restrictions. An authenticated attacker can exploit this to retrieve sensitive session metadata (e.g., 'createdWith') that should be restricted. The fix implements a two-step lookup in the 'handleMe' function to ensure 'protectedFields' and Class Level Permissions (CLP) are applied.
Affected products
- Parse Community Parse Server >= 9.0.0, < 9.8.0-alpha.7; >= 7.0.0, < 8.6.75
Timeline
- 2026-04-06: patched: Fixes merged in PR #10406 and #10407
- 2026-04-06: advisory: GitHub Security Advisory GHSA-g4v2-qx3q-4p64 published
- 2026-04-07: disclosed: CVE-2026-39381 published