GHSA-hwx8-q9cg-mqmc

Source

https://github.com/advisories/GHSA-hwx8-q9cg-mqmc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hwx8-q9cg-mqmc/GHSA-hwx8-q9cg-mqmc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hwx8-q9cg-mqmc

Aliases

Published

2026-03-09T17:42:03Z

Modified

2026-03-16T03:03:37Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

Details

Impact

The file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata.

This affects any deployment that relies on Parse.Cloud.beforeFind(Parse.File, ...) to restrict file access. Only file metadata (user-defined key-value pairs set via addMetadata) is exposed; file content remains protected.

Patches

The metadata handler now runs beforeFind and afterFind triggers and returns HTTP 403 when a trigger denies access.

Workarounds

Disable the metadata endpoint by overriding the route with a middleware that rejects all requests:

// Add before mounting Parse Server
app.get('/parse/files/:appId/metadata/:filename', (req, res) => {
  res.status(403).json({ error: 'Forbidden' });
});

Adjust the path prefix (/parse) to match your mountPath.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.9
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.9

Database specific

{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-09T17:42:03Z",
    "nvd_published_at":  "2026-03-07T17:15:52Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.6.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hwx8-q9cg-mqmc/GHSA-hwx8-q9cg-mqmc.json"

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0-alpha.1

Fixed

9.5.0-alpha.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hwx8-q9cg-mqmc/GHSA-hwx8-q9cg-mqmc.json"