GHSA-79wj-8rqv-jvp5

Source

https://github.com/advisories/GHSA-79wj-8rqv-jvp5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-79wj-8rqv-jvp5/GHSA-79wj-8rqv-jvp5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-79wj-8rqv-jvp5

Aliases

Published

2026-03-06T18:46:27Z

Modified

2026-03-16T03:02:46.890670Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Details

Impact

The readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected.

Patches

The fix adds a check to the /logInAs handler.

Workarounds

There is no workaround other than not using readOnlyMasterKey.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-79wj-8rqv-jvp5
Fix for Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.4
Fix for Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.6

Database specific

{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-06T18:46:27Z",
    "nvd_published_at": "2026-03-06T21:16:16Z"
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.6.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-79wj-8rqv-jvp5/GHSA-79wj-8rqv-jvp5.json"

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0

Fixed

9.5.0-alpha.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-79wj-8rqv-jvp5/GHSA-79wj-8rqv-jvp5.json"