Parse-Community · weakness class
Access Control
29 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 1
Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.
- Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration
- Information disclosure through Viewer query in parse-server
- Information disclosure in parse-server
- Parse Server subject to Incorrect Resource Transfer Between Spheres
- Parse Server ha a bypass of class-level permissions in LiveQuery
- Parse Server role escalation and CLP bypass via direct `_Join` table write
- Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
- Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
- Parse Server: LiveQuery bypasses CLP pointer permission enforcement
- Parse Server has a protected fields bypass via dot-notation in query and sort
- Parse Server's custom object ID allows to acquire role privileges
- Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
- Parse Server: Streaming file download bypasses afterFind file trigger authorization
- Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
- Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
- Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction
- Parse Server has a protected fields bypass via logical query operators
- Parse Server: Server option routeAllowList is bypassable through batch sub-requests
- Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
- Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
- Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
- Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
- Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
- Parse Server: Cloud function validator bypass via prototype chain traversal
- Parse Server: Session update endpoint allows overwriting server-generated session fields
- Parse Dashboard Missing Authorization on Agent Endpoint
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.