CVE-2026-30850 | THREATINT

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata. This issue has been patched in versions 8.6.9 and 9.5.0-alpha.9.

PUBLISHED Reserved 2026-03-05 | Published 2026-03-07 | Updated 2026-03-07 | Assigner GitHub_M

MEDIUM: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-862: Missing Authorization

Product status

< 8.6.9

affected

< 9.5.0-alpha.9

affected

References

github.com/...server/security/advisories/GHSA-hwx8-q9cg-mqmc

cve.org (CVE-2026-30850)

nvd.nist.gov (CVE-2026-30850)

Download JSON