CVE-2026-39381

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39381
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39381.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39381
Aliases
Published
2026-04-07T19:51:03.479Z
Modified
2026-07-27T03:56:42.728051086Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields. This vulnerability is fixed in 9.8.0-alpha.7 and 8.6.75.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39381.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
532a461d30a6ed4457839f2caf5f30d5abf51a55
Fixed
8b19852ff2c7d7a96d494f4402f17506242e078f
Introduced
c83de8c4eabb130fc4269361861f12df0abe3351
Fixed
1b2107eb7318a2b7b3f93d0bc76f0d28eba93f0d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.8.0-alpha.7"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "8.6.75"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

7.*
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
8.*
8.0.0
8.0.1
8.0.2
8.1.0
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.2.5
8.3.0
8.4.0
8.5.0
8.6.0
8.6.1
8.6.10
8.6.11
8.6.12
8.6.13
8.6.14
8.6.15
8.6.16
8.6.17
8.6.18
8.6.19
8.6.2
8.6.20
8.6.21
8.6.22
8.6.23
8.6.24
8.6.25
8.6.26
8.6.27
8.6.28
8.6.29
8.6.3
8.6.30
8.6.31
8.6.32
8.6.33
8.6.34
8.6.35
8.6.36
8.6.37
8.6.38
8.6.39
8.6.4
8.6.40
8.6.41
8.6.42
8.6.43
8.6.44
8.6.45
8.6.46
8.6.47
8.6.48
8.6.49
8.6.5
8.6.50
8.6.51
8.6.52
8.6.53
8.6.54
8.6.55
8.6.56
8.6.57
8.6.58
8.6.59
8.6.6
8.6.60
8.6.61
8.6.62
8.6.63
8.6.64
8.6.65
8.6.66
8.6.67
8.6.68
8.6.69
8.6.7
8.6.70
8.6.71
8.6.72
8.6.73
8.6.74
8.6.8
8.6.9
9.*
9.0.0
9.1.0
9.1.1
9.2.0
9.3.0
9.3.1
9.4.0
9.4.1
9.5.0
9.5.1
9.6.0
9.6.1
9.7.0
9.7.1-alpha.1
9.7.1-alpha.2
9.7.1-alpha.3
9.7.1-alpha.4
9.8.0-alpha.1
9.8.0-alpha.2
9.8.0-alpha.3
9.8.0-alpha.4
9.8.0-alpha.5
9.8.0-alpha.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39381.json"