QwikSec

Security Database

CVE

CWE

Training

CVE-2026-30229

Published: Mar 6, 2026

Modified: Mar 9, 2026

PUBLISHED

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected. This issue has been patched in versions 8.6.6 and 9.5.0-alpha.4.

Vendor	Product	Versions
parse-community	parse-server	affected `< 8.6.6` affected `< 9.5.0-alpha.4`

Weaknesses (CWE)

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-79wj-8rqv-jvp5

x_refsource_CONFIRM

https://github.com/parse-community/parse-server/releases/tag/8.6.6

x_refsource_MISC

https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.4

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.