CVE-2026-30962

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

6.5

CVSS v4.0

7.1

EPSS

0.30%

Published

Mar 10, 2026

Modified

Mar 11, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values. All Parse Server deployments have default protected fields and are vulnerable. This vulnerability is fixed in 9.5.2-alpha.6 and 8.6.19.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-284

Affected Products (7)

parseplatform · parse-server (up to 8.6.19)vulnerable

parseplatform · parse-server (up to 9.5.2)vulnerable

parseplatform · parse-servervulnerable

References (3)

https://github.com/parse-community/parse-server/releases/tag/8.6.19

ProductRelease Notes

https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.6

ProductRelease Notes

https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv

MitigationPatchVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs