CVE-2026-30229

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-30229
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30229.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-30229
Aliases
Published
2026-03-06T20:26:53.787Z
Modified
2026-04-10T05:41:46.742163Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected. This issue has been patched in versions 8.6.6 and 9.5.0-alpha.4.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30229.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
532a461d30a6ed4457839f2caf5f30d5abf51a55
Fixed
f0e3f32401da07b835a5487adb62c69e06ec3f8e

Affected versions

9.*
9.0.0
9.1.0
9.1.1
9.2.0
9.3.0
9.3.1
9.4.0
9.4.1
9.5.0-alpha.1
9.5.0-alpha.2
9.5.0-alpha.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30229.json"