CVE-2026-39381
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields. This vulnerability is fixed in 9.8.0-alpha.7 and 8.6.75.
| CWE | CWE-863 |
| Vendor | parse-community |
| Product | parse-server |
| Published | Apr 7, 2026 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for parse-community parse-server
Be the first to know when new unknown vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
parse-community / parse-server
>= 9.0.0, < 9.8.0-alpha.7 >= 7.0.0, < 8.6.75