GHSA-q3p6-g7c4-829c

Source

https://github.com/advisories/GHSA-q3p6-g7c4-829c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-q3p6-g7c4-829c/GHSA-q3p6-g7c4-829c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q3p6-g7c4-829c

Aliases

Published

2026-03-30T18:05:47Z

Modified

2026-04-06T15:27:10Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

GraphQL API endpoint ignores CORS origin restriction

Details

Impact

The GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction.

Patches

The GraphQL API endpoint now uses the same CORS middleware as the REST API, ensuring the allowOrigin and allowHeaders server options are consistently enforced across all endpoints.

Workarounds

There is no known workaround other than upgrading.

Resources

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c
Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10334
Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10335

Database specific

{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-30T18:05:47Z",
    "nvd_published_at":  "2026-03-31T15:16:19Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0

Fixed

9.7.0-alpha.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-q3p6-g7c4-829c/GHSA-q3p6-g7c4-829c.json"

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

3.5.0

Fixed

8.6.66

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-q3p6-g7c4-829c/GHSA-q3p6-g7c4-829c.json"