Skip to content

Commit 5c6af6b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-hm3f-q6rw-m6wh GHSA-hwx8-q9cg-mqmc GHSA-q5q9-2rhp-33qw GHSA-x6fw-778m-wr9v
1 parent 9073bd8 commit 5c6af6b

File tree

4 files changed

+301
-0
lines changed

4 files changed

+301
-0
lines changed

‎advisories/github-reviewed/2026/03/GHSA-hm3f-q6rw-m6wh/GHSA-hm3f-q6rw-m6wh.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hm3f-q6rw-m6wh",
4+
"modified": "2026-03-09T17:41:55Z",
5+
"published": "2026-03-09T17:41:55Z",
6+
"aliases": [
7+
"CVE-2026-30848"
8+
],
9+
"summary": "Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory",
10+
"details": "### Impact\n\nThe `PagesRouter` static file serving route is vulnerable to a path traversal attack that allows unauthenticated reading of files outside the configured `pagesPath` directory. The boundary check uses a string prefix comparison without enforcing a directory separator boundary. An attacker can use path traversal sequences to access files in sibling directories whose names share the same prefix as the pages directory (e.g. `pages-secret` starts with `pages`).\n\nThis affects any Parse Server deployment with the `pages` feature enabled (`pages.enableRouter: true`). Exploitation requires a sibling directory of `pagesPath` whose name begins with the same string as the pages directory name.\n\n### Patches\n\nThe fix enforces a path separator boundary in the check, ensuring resolved paths must be strictly inside the `pagesPath` directory.\n\n### Workarounds\n\nEnsure the `pagesPath` directory has no sibling directories whose names begin with the same prefix. For example, if `pagesPath` is `/srv/pages`, ensure no directory like `/srv/pages-backup` or `/srv/pages_old` exists alongside it.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-hm3f-q6rw-m6wh\n- Fix for Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.8\n- Fix for Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.8",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "8.6.8"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "9.0.0-alpha.1"
48+
},
49+
{
50+
"fixed": "9.5.0-alpha.8"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-hm3f-q6rw-m6wh"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30848"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/parse-community/parse-server"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-22"
74+
],
75+
"severity": "MODERATE",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-03-09T17:41:55Z",
78+
"nvd_published_at": "2026-03-07T17:15:52Z"
79+
}
80+
}

‎advisories/github-reviewed/2026/03/GHSA-hwx8-q9cg-mqmc/GHSA-hwx8-q9cg-mqmc.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hwx8-q9cg-mqmc",
4+
"modified": "2026-03-09T17:42:03Z",
5+
"published": "2026-03-09T17:42:03Z",
6+
"aliases": [
7+
"CVE-2026-30850"
8+
],
9+
"summary": "Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization",
10+
"details": "### Impact\n\nThe file metadata endpoint (GET `/files/:appId/metadata/:filename`) does not enforce `beforeFind` / `afterFind` file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata.\n\nThis affects any deployment that relies on `Parse.Cloud.beforeFind(Parse.File, ...)` to restrict file access. Only file metadata (user-defined key-value pairs set via addMetadata) is exposed; file content remains protected.\n\n### Patches\n\nThe metadata handler now runs `beforeFind` and `afterFind` triggers and returns HTTP 403 when a trigger denies access.\n\n### Workarounds\n\nDisable the `metadata` endpoint by overriding the route with a middleware that rejects all requests:\n\n```js\n// Add before mounting Parse Server\napp.get('/parse/files/:appId/metadata/:filename', (req, res) => {\n res.status(403).json({ error: 'Forbidden' });\n});\n```\n\nAdjust the path prefix (`/parse`) to match your mountPath.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.9\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.9",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "8.6.9"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "9.0.0-alpha.1"
48+
},
49+
{
50+
"fixed": "9.5.0-alpha.9"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30850"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/parse-community/parse-server"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-862"
74+
],
75+
"severity": "MODERATE",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-03-09T17:42:03Z",
78+
"nvd_published_at": "2026-03-07T17:15:52Z"
79+
}
80+
}

‎advisories/github-reviewed/2026/03/GHSA-q5q9-2rhp-33qw/GHSA-q5q9-2rhp-33qw.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q5q9-2rhp-33qw",
4+
"modified": "2026-03-09T17:42:17Z",
5+
"published": "2026-03-09T17:42:17Z",
6+
"aliases": [
7+
"CVE-2026-30854"
8+
],
9+
"summary": "Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled",
10+
"details": "### Impact\n\nWhen `graphQLPublicIntrospection` is disabled, `__type` queries nested inside inline fragments (e.g. `... on Query { __type(name:\"User\") { name } })` bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. `__schema` introspection is not affected.\n\n### Patches\n\nThe check was changed from a flat iteration over root-level selections to a recursive walk of all selection sets, detecting `__type` inside inline fragments at any depth.\n\n### Workarounds\n\nRequire master key authentication at the network layer (e.g. reverse proxy) for the GraphQL endpoint.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.10",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.3.1-alpha.3"
29+
},
30+
{
31+
"fixed": "9.5.0-alpha.10"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30854"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/parse-community/parse-server"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-863"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-09T17:42:17Z",
59+
"nvd_published_at": "2026-03-07T17:15:52Z"
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-x6fw-778m-wr9v/GHSA-x6fw-778m-wr9v.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x6fw-778m-wr9v",
4+
"modified": "2026-03-09T17:42:22Z",
5+
"published": "2026-03-09T17:42:22Z",
6+
"aliases": [
7+
"CVE-2026-30863"
8+
],
9+
"summary": "Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters",
10+
"details": "### Impact\n\nThe Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration option is not set (`clientId` for Google/Apple, `appIds` for Facebook), JWT verification silently skips audience claim validation. This allows an attacker to use a validly signed JWT issued for a different application to authenticate as any user on the target Parse Server.\n\n- For Google and Apple, the vulnerability is exploitable when the server does not configure `clientId`. The adapters accepted this as valid and simply skipped audience validation.\n- For Facebook Limited Login, the vulnerability exists regardless of configuration. The adapter validated `appIds` only for Standard Login (Graph API), but the Limited Login JWT path never passed `appIds` as the audience to JWT verification.\n\n### Patches\n\nThe fix enforces `clientId` (Google/Apple) and `appIds` (Facebook) as mandatory and passes them to JWT verification for audience validation. While this is technically a breaking change for servers that omit these options, it is not a breaking change as per documentation — all three options are documented as required configuration.\n\n### Workarounds\n\n- Google / Apple: Ensure `clientId` is set in the adapter configuration. When set, JWT verification correctly validates the audience claim even on unpatched versions.\n- Facebook Limited Login: There is no workaround. The unpatched adapter does not pass `appIds` to JWT audience validation, so the only mitigation is to upgrade.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.11\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.10",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "9.5.0-alpha.11"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.10"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30863"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/parse-community/parse-server"
69+
}
70+
],
71+
"database_specific": {
72+
"cwe_ids": [
73+
"CWE-287"
74+
],
75+
"severity": "CRITICAL",
76+
"github_reviewed": true,
77+
"github_reviewed_at": "2026-03-09T17:42:22Z",
78+
"nvd_published_at": "2026-03-07T17:15:54Z"
79+
}
80+
}

0 commit comments

Comments
 (0)