VulnerabilityAnalyzed

CVE-2026-29182

Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations.

HIGH 8.6EPSS 0.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration. Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability. This issue has been patched in versions 8.6.4 and 9.4.1-alpha.3.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.38% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: parseplatform/parse-server
Source: security-advisories@github.com

References

https://github.com/parse-community/parse-server/releases/tag/8.6.4Patch, Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3Patch, Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhhVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.