Skip to content

Commit 98bdeb7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5f92-jrq3-28rc GHSA-775h-3xrc-c228 GHSA-7m6r-fhh7-r47c GHSA-7xg7-rqf6-pw6c GHSA-fr88-w35c-r596 GHSA-rfx7-4xw3-gh4m
1 parent c012ca5 commit 98bdeb7

6 files changed

Lines changed: 504 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-5f92-jrq3-28rc/GHSA-5f92-jrq3-28rc.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5f92-jrq3-28rc",
4+
"modified": "2026-03-11T00:21:07Z",
5+
"published": "2026-03-11T00:21:07Z",
6+
"aliases": [
7+
"CVE-2026-30966"
8+
],
9+
"summary": "Parse Server has role escalation and CLP bypass via direct `_Join` table write",
10+
"details": "### Impact\n\nParse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required.\n\nAn attacker can create, read, update, or delete records in any internal relationship table. Exploiting this allows the attacker to inject themselves into any Parse Role, gaining all permissions associated with that role, including full read, write, and delete access to classes protected by role-based Class-Level Permissions (CLP). Similarly, writing to any such table that backs a Relation field used in a `pointerFields` CLP bypasses that access control.\n\n### Patches\n\nThe fix blocks direct client access to internal relationship tables in Parse Server's role security enforcement. All create, find, get, update, and delete operations on these tables now require the master key or maintenance key.\n\n### Workarounds\n\nThere is no known workaround.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5f92-jrq3-28rc\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.7\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.20",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "9.5.2-alpha.7"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.20"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-5f92-jrq3-28rc"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30966"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/parse-community/parse-server"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.20"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.7"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-284"
82+
],
83+
"severity": "CRITICAL",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-03-11T00:21:07Z",
86+
"nvd_published_at": "2026-03-10T21:16:48Z"
87+
}
88+
}

‎advisories/github-reviewed/2026/03/GHSA-775h-3xrc-c228/GHSA-775h-3xrc-c228.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-775h-3xrc-c228",
4+
"modified": "2026-03-11T00:21:51Z",
5+
"published": "2026-03-11T00:21:51Z",
6+
"aliases": [
7+
"CVE-2026-30972"
8+
],
9+
"summary": "Parse Server has a rate limit bypass via batch request endpoint",
10+
"details": "### Impact\n\nParse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (`/batch`) processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle multiple requests targeting a rate-limited endpoint into a single batch request to circumvent the configured rate limit.\n\nAny Parse Server deployment that relies on the built-in rate limiting feature is affected.\n\n### Patches\n\nThe fix adds a pre-flight check in the batch request handler that counts the number of sub-requests targeting each rate-limited path and rejects the entire batch request if any path's count exceeds its configured `requestCount`.\n\nNote that this is a server-level rate limit that counts sub-requests within a single batch request. Requests already consumed in the current time window by previous individual or batch requests are not counted against the batch, so the effective limit may be higher when combining individual and batch requests. For comprehensive rate limiting protection, use a reverse proxy or WAF.\n\n### Workarounds\n\nUse a reverse proxy or web application firewall (WAF) to enforce rate limiting before requests reach Parse Server.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.10\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.23",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "9.5.2-alpha.10"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.23"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30972"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/parse-community/parse-server"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.23"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.10"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-799"
82+
],
83+
"severity": "MODERATE",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-03-11T00:21:51Z",
86+
"nvd_published_at": "2026-03-10T21:16:49Z"
87+
}
88+
}

‎advisories/github-reviewed/2026/03/GHSA-7m6r-fhh7-r47c/GHSA-7m6r-fhh7-r47c.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7m6r-fhh7-r47c",
4+
"modified": "2026-03-11T00:23:21Z",
5+
"published": "2026-03-11T00:23:21Z",
6+
"aliases": [
7+
"CVE-2026-31828"
8+
],
9+
"summary": "Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction",
10+
"details": "### Impact\n\nThe LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (`authData.id`) is interpolated directly into LDAP Distinguished Names (DN) and group search filters without escaping special characters. This allows an attacker with valid LDAP credentials to manipulate the bind DN structure and to bypass group membership checks. This enables privilege escalation from any authenticated LDAP user to a member of any restricted group.\n\nThe vulnerability affects Parse Server deployments that use the LDAP authentication adapter with group-based access control.\n\n### Patches\n\nThe vulnerability is fixed by escaping user input before interpolation into DN strings (per [RFC 4514](https://datatracker.ietf.org/doc/html/rfc4514#section-2.4)) and LDAP filter strings (per [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515#section-3)).\n\n### Workarounds\n\nThere is no known workaround.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.13\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.26",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "9.5.2-alpha.13"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.26"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/parse-community/parse-server"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.26"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.13"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-90"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-03-11T00:23:21Z",
82+
"nvd_published_at": null
83+
}
84+
}

‎advisories/github-reviewed/2026/03/GHSA-7xg7-rqf6-pw6c/GHSA-7xg7-rqf6-pw6c.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7xg7-rqf6-pw6c",
4+
"modified": "2026-03-11T00:23:01Z",
5+
"published": "2026-03-11T00:23:01Z",
6+
"aliases": [
7+
"CVE-2026-31800"
8+
],
9+
"summary": "Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes",
10+
"details": "### Impact\n\nThe `_GraphQLConfig` and `_Audience` internal classes can be read, modified, and deleted via the generic `/classes/_GraphQLConfig` and `/classes/_Audience` REST API routes without master key authentication. This bypasses the master key enforcement that exists on the dedicated `/graphql-config` and `/push_audiences` endpoints. An attacker can read, modify and delete GraphQL configuration and push audience data.\n\n### Patches\n\nThe fix adds the affected internal classes to the `classesWithMasterOnlyAccess` list, ensuring that the generic `/classes/` routes enforce master key access consistently with the dedicated endpoints.\n\n### Workarounds\n\nThere is no known workaround.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.25",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "9.5.2-alpha.12"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.25"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31800"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/parse-community/parse-server"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.25"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-862"
82+
],
83+
"severity": "HIGH",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2026-03-11T00:23:01Z",
86+
"nvd_published_at": "2026-03-10T21:16:49Z"
87+
}
88+
}

0 commit comments

Comments
 (0)