Executive brief
Parse Server is an open-source backend framework used to build and host mobile and web applications. A security flaw in its route filtering system allows attackers to bypass access restrictions by wrapping unauthorized requests inside a 'batch' command. While standard data permissions (ACLs) still apply, this allows attackers to interact with API endpoints that administrators intended to block entirely from external access.
Technical details
The 'routeAllowList' feature in Parse Server v9.8.0+ acts as an Express middleware to restrict access to specific REST API routes. However, the implementation only validates the top-level request URL. An attacker can use the '/batch' endpoint (if allowlisted) to submit sub-requests to any internal REST route, bypassing the allow-list check because the batch handler dispatches sub-requests directly to the internal router without re-verifying them against the allow-list. While internal authorization controls like ACLs and CLPs remain active, the network-level 'firewall' provided by routeAllowList is negated. The issue is fixed in version 9.9.1-alpha.3 by enforcing the allow-list check per sub-request.
Affected products
- parse-community parse-server >= 9.8.0, < 9.9.1-alpha.3
Timeline
- 2026-05-27: disclosed: Initial disclosure to vendor
- 2026-06-12: advisory: NVD publication date
- 2026-06-19: advisory: GitHub Advisory published