CVE-2026-30228: parse-server File Creation and Deletion Bypass of readOnlyMasterKey Restrictions
Summary
CVE-2026-30228: parse-server's file creation and deletion bypasses readOnlyMasterKey write restriction. Affects parse-server across 2 version ranges.
< 8.6.5
>= 9.0.0, < 9.5.0-alpha.3
Fixed in 8.6.5 or 9.5.0-alpha.3, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-30228 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user authentication, and file management through its Files API. However, a vulnerability has been identified that allows unauthorized file creation and deletion when using the readOnlyMasterKey, undermining its intended access restrictions.
Vulnerability Detail
The vulnerability arises from the Files API's failure to enforce proper permission checks when using the readOnlyMasterKey. This allows an attacker with access to this key to create or delete files arbitrarily, violating the access control intended for the readOnlyMasterKey. The impact is significant as it can lead to unauthorized data manipulation and potential data loss.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.58.6.5npm install parse-server@8.6.5 -
>= 9.0.0, < 9.5.0-alpha.39.5.0-alpha.3npm install parse-server@9.5.0-alpha.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the readOnlyMasterKey for operations that require file creation or deletion. Additionally, restrict network access to the Files API endpoints to mitigate exposure.
Conclusion
The CVE-2026-30228 vulnerability in parse-server allows unauthorized file operations through the Files API when using the readOnlyMasterKey. It is crucial to update to the patched versions to secure your application and prevent potential exploitation.
See every vulnerability recorded for parse-server →
FAQ
The readOnlyMasterKey is a special key in Parse Server that is intended to provide read-only access to data, preventing any write operations.
An attacker with access to the readOnlyMasterKey can use the Files API to upload or delete files, bypassing the intended restrictions.
The consequences include unauthorized file manipulation, potential data loss, and violation of data integrity within the application.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
