CVE-2026-30850: Parse Server Auth Bypass Vulnerability

CVE-2026-30850 Overview

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, contains an authorization bypass vulnerability in its file metadata endpoint. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) fails to enforce beforeFind and afterFind file triggers. When these triggers are implemented as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata.

Critical Impact

Unauthorized users can access sensitive file metadata by bypassing configured access control triggers, potentially exposing confidential information about stored files.

Affected Products

• Parse Server versions prior to 8.6.9
• Parse Server version 9.5.0 through 9.5.0-alpha.8
• All Parse Server deployments using beforeFind/afterFind triggers for file access control

Discovery Timeline

• 2026-03-07 - CVE-2026-30850 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-30850

Vulnerability Analysis

This vulnerability represents an Authorization Bypass (CWE-862: Missing Authorization) in Parse Server's file handling subsystem. The core issue stems from an inconsistent application of security controls across different file-related endpoints.

Parse Server provides file triggers (beforeFind and afterFind) that allow developers to implement custom access control logic for file operations. These triggers are commonly used to restrict file access based on user roles, permissions, or other application-specific criteria. However, the file metadata endpoint was implemented without integrating these trigger hooks, creating a security gap.

When an attacker sends a request to /files/:appId/metadata/:filename, the server processes the request and returns file metadata without invoking the configured trigger functions. This allows attackers to enumerate files, discover file properties, and potentially gather information that should be protected by the application's access control policies.

Root Cause

The root cause is the missing integration of the beforeFind and afterFind trigger system within the file metadata endpoint handler. While the main file access endpoints properly invoke these triggers before processing requests, the metadata endpoint was implemented as a separate code path that omits these security checks. This represents an incomplete implementation of the security boundary around file operations.

Attack Vector

The attack is network-accessible and requires no authentication when the application relies solely on file triggers for access control. An attacker can exploit this vulnerability by:

1. Identifying a Parse Server instance with the vulnerable endpoint exposed
2. Crafting HTTP GET requests to the file metadata endpoint with known or guessed filenames
3. Receiving file metadata that would normally be protected by beforeFind/afterFind triggers

The vulnerability is exploited via direct HTTP requests to the metadata endpoint, bypassing any access control logic implemented through file triggers. This can lead to unauthorized disclosure of file properties including timestamps, sizes, and other metadata that applications may consider sensitive.

Detection Methods for CVE-2026-30850

Indicators of Compromise

• Unusual or unexpected HTTP GET requests to /files/*/metadata/* endpoints from unauthorized sources
• Elevated volume of requests to file metadata endpoints compared to normal application usage patterns
• Access logs showing metadata endpoint requests from IP addresses or user agents not associated with legitimate users
• File metadata requests for files that should not be accessible to the requesting entity based on application logic

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on access patterns to the /files/:appId/metadata/:filename endpoint
• Configure application-level logging to capture all requests to file metadata endpoints with full request context
• Deploy anomaly detection for API endpoints to identify unusual access patterns that may indicate exploitation attempts

Monitoring Recommendations

• Enable detailed access logging on Parse Server instances and forward logs to a centralized SIEM for analysis
• Create alerts for file metadata endpoint access from unauthenticated sessions or unexpected client applications
• Monitor for reconnaissance patterns such as sequential filename enumeration or metadata scraping behavior
• Establish baseline metrics for normal file metadata access and alert on deviations

How to Mitigate CVE-2026-30850

Immediate Actions Required

• Upgrade Parse Server to version 8.6.9 or 9.5.0-alpha.9 or later immediately
• Audit application logs for evidence of unauthorized file metadata access
• Review applications using file triggers to determine exposure scope and identify potentially compromised file information
• Implement additional network-level access controls to restrict access to Parse Server endpoints while patches are applied

Patch Information

Parse Platform has released patched versions that address this vulnerability. The fix ensures that beforeFind and afterFind file triggers are properly invoked when handling requests to the file metadata endpoint. For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level access controls (firewall rules, reverse proxy configuration) to restrict access to the file metadata endpoint to trusted sources only
• Add middleware or custom route handlers that enforce authentication and authorization checks before requests reach the Parse Server file metadata endpoint
• Consider disabling the file metadata endpoint entirely if it is not required for application functionality
• Deploy API gateway policies to block or restrict access to the vulnerable endpoint pattern

# Example nginx configuration to restrict metadata endpoint access
location ~ ^/files/.*/metadata/ {
    # Restrict to internal networks only
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;
    
    # Or require authentication header
    # if ($http_authorization = "") {
    #     return 401;
    # }
    
    proxy_pass http://parse-server:1337;
}