CVE-2026-30229

UNKNOWN 0.0

Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected. This issue has been patched in versions 8.6.6 and 9.5.0-alpha.4.

CWE	CWE-863
Vendor	parse-community
Product	parse-server
Published	Mar 6, 2026
Last Updated	Mar 9, 2026

Stay Ahead of the Next One

Get instant alerts for parse-community parse-server

Be the first to know when new unknown vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

parse-community / parse-server

< 8.6.6 < 9.5.0-alpha.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/parse-community/parse-server/security/advisories/GHSA-79wj-8rqv-jvp5 github.com: https://github.com/parse-community/parse-server/releases/tag/8.6.6 github.com: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.4