CVE-2026-31800 - Vulnerability Analysis

Overview

Parse Server < 9.5.2-alpha.12 and < 8.6.25 contains a broken access control vulnerability caused by lack of master key authentication on /classes/_GraphQLConfig and /classes/_Audience REST API routes, letting attackers read, modify, and delete GraphQL configuration and push audience data, exploit requires no special privileges.

Severity & Score

Impact

Attackers can read, modify, and delete sensitive configuration and audience data, potentially disrupting service and exposing sensitive information.

Mitigation

Update to version 9.5.2-alpha.12 or 8.6.25 or later.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c
• https://github.com/parse-community/parse-server/releases/tag/8.6.25
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner