CVE-2026-50008: Parse Server authorization bypass via batch sub-requests

CVE-2026-50008 · Severity: medium · CVSS 4 · Published 2026-06-12

Parse Server is an open-source backend framework used to build and host mobile and web applications. A security flaw in its route filtering system allows attackers to bypass access restrictions by wrapping unauthorized requests inside a 'batch' command. While standard data permissions (ACLs) still apply, this allows attackers to interact with API endpoints that administrators intended to block entirely from external access.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-50008 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50008 being exploited in the wild.
How severe is CVE-2026-50008?
Medium severity, with a CVSS score of 4, published 12 June 2026.
Which products and versions are affected?
parse-server (npm) >= 9.8.0, < 9.9.1-alpha.3, SEMVER:introduced=9.8.0,fixed=9.9.1-alpha.3.
Is there a fix for CVE-2026-50008?
Yes. parse-server (npm): upgrade to 9.9.1-alpha.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50008 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50008?
Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • parse-server (npm): upgrade to 9.9.1-alpha.3 or later
    npm install parse-server@9.9.1-alpha.3

Technical details

The 'routeAllowList' feature in Parse Server v9.8.0+ acts as an Express middleware to restrict access to specific REST API routes. However, the implementation only validates the top-level request URL. An attacker can use the '/batch' endpoint (if allowlisted) to submit sub-requests to any internal REST route, bypassing the allow-list check because the batch handler dispatches sub-requests directly to the internal router without re-verifying them against the allow-list. While internal authorization controls like ACLs and CLPs remain active, the network-level 'firewall' provided by routeAllowList is negated. The issue is fixed in version 9.9.1-alpha.3 by enforcing the allow-list check per sub-request.

Affected products

  • parse-community parse-server >= 9.8.0, < 9.9.1-alpha.3

Identifiers

  • CVE-2026-50008
  • GHSA-p84r-h6rx-f2xr

Timeline

  • 2026-05-27: disclosed: Initial disclosure to vendor
  • 2026-06-12: advisory: NVD publication date
  • 2026-06-19: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.