GHSA-vc89-5g3r-cmhh

Source

https://github.com/advisories/GHSA-vc89-5g3r-cmhh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vc89-5g3r-cmhh/GHSA-vc89-5g3r-cmhh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vc89-5g3r-cmhh

Aliases

Published

2026-03-05T00:33:18Z

Modified

2026-03-16T03:04:54Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction

Details

Impact

Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration.

Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability.

Patches

The fix adds authorization checks, rejecting mutating requests made with the readOnlyMasterKey.

Workarounds

There is no known workaround other than upgrading. If upgrading is not immediately possible, ensure the readOnlyMasterKey value is not shared with untrusted parties.

Resources

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh
Fixed in Parse Server 9.4.1-alpha.3: https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3
Fixed in Parse Server 8.6.4: https://github.com/parse-community/parse-server/releases/tag/8.6.4

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-05T00:33:18Z",
    "nvd_published_at":  "2026-03-06T21:16:15Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0

Fixed

9.4.1-alpha.3

Database specific

last_known_affected_version_range

"<= 9.4.1-alpha.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vc89-5g3r-cmhh/GHSA-vc89-5g3r-cmhh.json"