CVE-2026-112769 Overview
CVE-2026-112769 is an authorization flaw [CWE-863] in Parse Server, an open-source backend framework for building applications. Parse Server versions before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 fail to enforce the create and addField class-level permissions (CLPs) on the _Session class. An authenticated user, or any party holding a valid session token, can issue POST requests to /sessions or /classes/_Session to create additional sessions for that user and add fields to _Session. The newly created sessions persist beyond the logout of the original session, enabling session continuity that administrators cannot easily revoke.
Critical Impact
Authenticated attackers can mint persistent session tokens that survive user logout, undermining session revocation controls.
Affected Products
- Parse Server versions prior to 8.6.98
- Parse Server 9.0.0 through versions before 9.10.3-alpha.1
- Applications relying on Parse Server _Session class-level permissions for access control
Discovery Timeline
- 2026-10-19 - CVE-2026-112769 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-112769
Vulnerability Analysis
Parse Server exposes the _Session system class to manage authentication tokens. Parse applications protect classes using class-level permissions that restrict who can create records or add fields. In the affected versions, the server skips CLP enforcement for the _Session class during session creation operations.
An authenticated user can send a POST request to /sessions or /classes/_Session and successfully create new session records bound to their own user identity. The server also permits arbitrary field additions through the addField operation on the same class. Because the attacker-created sessions are independent records, the Parse Server logout flow does not invalidate them when the original session ends.
The practical consequence is session persistence. A compromised session token can be used, prior to its revocation, to mint secondary tokens that remain valid indefinitely. This defeats session termination as a containment control after credential theft or token leakage.
Root Cause
The root cause is missing authorization enforcement on the _Session class. The code path handling session creation and schema modification does not evaluate the configured create and addField CLPs. This is a classic Incorrect Authorization weakness [CWE-863] where documented access controls exist in configuration but are not applied at runtime.
Attack Vector
Exploitation requires network access to the Parse Server REST endpoint and a valid session token for any user account. The attacker sends an authenticated POST to /parse/sessions or /parse/classes/_Session containing session payload data. The server returns a new session token tied to the attacker's user. Repeating the request produces multiple parallel tokens. These tokens remain active after the originating session is logged out, giving the attacker a durable foothold.
See the GitHub Security Advisory GHSA-gj37-5hg5-p729 and the Vulncheck Advisory for Parse Server session bypass for additional technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-112769
Indicators of Compromise
- Multiple active session records in the _Session collection tied to the same user pointer with overlapping createdAt timestamps.
- Session records that remain in the database after a corresponding logout event in application logs.
- Unexpected custom fields present on documents in the _Session class not defined in the application schema.
Detection Strategies
- Audit the _Session MongoDB or PostgreSQL collection for session counts per user that exceed expected device or client counts.
- Review Parse Server access logs for POST requests to /parse/sessions or /parse/classes/_Session originating from client application contexts rather than server-side master key operations.
- Compare session creation events to authentication events; sessions created without a preceding logIn call warrant investigation.
Monitoring Recommendations
- Forward Parse Server HTTP access logs and database audit logs to a centralized log platform for correlation.
- Alert on addField schema change requests targeting the _Session class from non-master-key callers.
- Track session token lifetime distributions and flag outliers that persist well beyond typical user sessions.
How to Mitigate CVE-2026-112769
Immediate Actions Required
- Upgrade Parse Server to version 8.6.98 or 9.10.3-alpha.1 or later as published by the Parse Community.
- Invalidate all existing session tokens after upgrading and require users to re-authenticate.
- Audit the _Session class for unauthorized records and unexpected custom fields, removing any anomalies.
Patch Information
The Parse Community addressed CVE-2026-112769 in Parse Server 8.6.98 and 9.10.3-alpha.1. Refer to GitHub Security Advisory GHSA-gj37-5hg5-p729 for the authoritative patch notes and version guidance.
Workarounds
- Restrict network access to the Parse Server REST API through an upstream reverse proxy that filters POST requests to /parse/sessions and /parse/classes/_Session from untrusted clients.
- Shorten session token expiration windows to limit the useful lifetime of tokens an attacker could mint.
- Implement periodic server-side cleanup jobs that revoke orphaned session records lacking a corresponding active login.
# Upgrade Parse Server to a patched release
npm install parse-server@8.6.98
# or for the 9.x branch
npm install parse-server@9.10.3-alpha.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
