CVE-2026-50008

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the allow-list check. An external caller whose outer route matches batch can issue batch sub-requests to any REST API route that the operator omitted from the allow-list. Authentication, ACL, CLP, and other inner-route authorization controls still apply — only the operator-configured route firewall is bypassed. This issue has been patched in version 9.9.1-alpha.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/parse-community/parse-server/pull/10482
https://github.com/parse-community/parse-server/security/advisories/GHSA-p84r-h6rx-f2xr

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Desde la versión 9.8.0 hasta antes de la versión 9.9.1-alpha.3, la opción de servidor routeAllowList restringe el acceso de clientes externos a una lista configurada de rutas de API REST. La verificación solo se aplica como middleware de Express contra la URL de la solicitud HTTP externa, por lo que el gestor /batch despacha cada sub-solicitud al router interno sin volver a ejecutar la verificación de la lista de permitidos. Un llamador externo cuya ruta externa coincide con batch puede emitir sub-solicitudes por lotes a cualquier ruta de API REST que el operador omitió de la lista de permitidos. Autenticación, ACL, CLP y otros controles de autorización de ruta interna aún se aplican - solo se omite el cortafuegos de ruta configurado por el operador. Este problema ha sido parcheado en la versión 9.9.1-alpha.3.

Information

Published : 2026-06-12 19:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-50008

Mitre link : CVE-2026-50008

CVE.ORG link : CVE-2026-50008

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-50008", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50008", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T19:00:45.285194Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "parse-community", "product": "parse-server", "versions": [{"status": "affected", "version": ">= 9.8.0, < 9.9.1-alpha.3"}]}]}], "published": "2026-06-12T19:16:29.187", "references": [{"url": "https://github.com/parse-community/parse-server/pull/10482", "source": "security-advisories@github.com"}, {"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-p84r-h6rx-f2xr", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the allow-list check. An external caller whose outer route matches batch can issue batch sub-requests to any REST API route that the operator omitted from the allow-list. Authentication, ACL, CLP, and other inner-route authorization controls still apply \u2014 only the operator-configured route firewall is bypassed. This issue has been patched in version 9.9.1-alpha.3."}, {"lang": "es", "value": "Parse Server es un backend de c\u00f3digo abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Desde la versi\u00f3n 9.8.0 hasta antes de la versi\u00f3n 9.9.1-alpha.3, la opci\u00f3n de servidor routeAllowList restringe el acceso de clientes externos a una lista configurada de rutas de API REST. La verificaci\u00f3n solo se aplica como middleware de Express contra la URL de la solicitud HTTP externa, por lo que el gestor /batch despacha cada sub-solicitud al router interno sin volver a ejecutar la verificaci\u00f3n de la lista de permitidos. Un llamador externo cuya ruta externa coincide con batch puede emitir sub-solicitudes por lotes a cualquier ruta de API REST que el operador omiti\u00f3 de la lista de permitidos. Autenticaci\u00f3n, ACL, CLP y otros controles de autorizaci\u00f3n de ruta interna a\u00fan se aplican - solo se omite el cortafuegos de ruta configurado por el operador. Este problema ha sido parcheado en la versi\u00f3n 9.9.1-alpha.3."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}