Authorization Bypass in Parse Server by Parse Community
CVE-2026-121413

2.3LOW

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121413?

Parse Server prior to version 8.6.112 and 9.0.0 before 9.10.6-alpha.4 is exposed to an authorization bypass through its session upgrade endpoint. This vulnerability allows attackers with access to a user's valid session token to invoke the /upgradeToRevocableSession function. Without enforcing the class-level permissions of the _Session class, attackers can regenerate a session with a fresh expiration, even after the original session has been logged out. This flaw poses a significant risk as it enables prolonged unauthorized access to user accounts.

Affected Version(s)

parse-server 9.0.0 < 9.10.6-alpha.4

parse-server 0 < 8.6.112

parse-server 9.10.6-alpha.4

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://github.com/parse-community/parse-server/pull/10808
patchissue-tracking
https://github.com/parse-community/parse-server/pull/10809
patchissue-tracking

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.