CVE-2026-31800CRITICAL 9.1EPSS p25.1%

CVE-2026-31800CVE-2026-31800

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the _GraphQLConfig and _Audience internal classes can be read, modified, and deleted via the generic /classes/_GraphQLConfig and /classes/_Audience REST API routes without master key authentication. This bypasses the master key enforcement that exists on the dedicated /graphql-config and /push_audiences endpoints. An attacker can read, modify and delete GraphQL configuration and push audience data. This vulnerability is fixed in 9.5.2-alpha.12 and 8.6.25.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.34% probability of exploitation · percentile 25.1% · 2026-06-18T12:00:27Z
Published2026-03-10
Last modified2026-03-11

Underlying weaknesses· 1

CWE-862

References

  1. https://github.com/parse-community/parse-server/releases/tag/8.6.25
  2. https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12
  3. https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c

1

TypeTargetConfidenceTier
WeaknessMissing Authorizationcwe-8620%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-30966
CVE
CVE-2026-30965
CVE
CVE-2026-32248
CVE
CVE-2026-30863
CVE
CVE-2026-34373
CVE
CVE-2026-30967
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.