CVE-2026-30850: Parse Server File Metadata Endpoint Bypass Vulnerability
Summary
CVE-2026-30850: Parse Server: File metadata endpoint bypasses beforeFind / afterFind trigger authorization. Affects parse-server across 2 version ranges.
< 8.6.9
>= 9.0.0-alpha.1, < 9.5.0-alpha.9
Fixed in 8.6.9 or 9.5.0-alpha.9, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-30850 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust cloud infrastructure. It provides features such as data storage, user management, and file handling. However, it has a vulnerability in its file metadata endpoint that can lead to unauthorized access to file metadata, compromising the security of applications relying on this framework.
Vulnerability Detail
The vulnerability arises from the file metadata endpoint (GET /files/:appId/metadata/:filename) not enforcing the 'beforeFind' and 'afterFind' triggers that are typically used for access control. This oversight allows unauthorized users to access file metadata, which includes user-defined key-value pairs set via addMetadata. While the file content remains protected, the exposure of metadata can lead to privacy concerns and unauthorized information disclosure.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.98.6.9npm install parse-server@8.6.9 -
>= 9.0.0-alpha.1, < 9.5.0-alpha.99.5.0-alpha.9npm install parse-server@9.5.0-alpha.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, you can disable the metadata endpoint by adding the following middleware before mounting Parse Server:
// Add before mounting Parse Server
app.get('/parse/files/:appId/metadata/:filename', (req, res) => {
res.status(403).json({ error: 'Forbidden' });
});
Make sure to adjust the path prefix ('/parse') to match your mountPath.
Conclusion
The CVE-2026-30850 vulnerability in Parse Server poses a risk by allowing unauthorized access to file metadata through the metadata endpoint. It is crucial to update to the patched versions or implement the provided workaround to mitigate this risk and protect sensitive information.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability allows unauthorized access to file metadata, which can lead to privacy concerns and potential misuse of sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions prior to 8.6.9 and 9.0.0-alpha.1 are affected by this vulnerability.
You can implement the provided workaround to disable the metadata endpoint temporarily until you can apply the patch.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
