CVE-2026-31800: Parse-server Auth Bypass Vulnerability

CVE-2026-31800 Overview

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, contains a critical authentication bypass vulnerability in versions prior to 9.5.2-alpha.12 and 8.6.25. The vulnerability allows unauthorized access to the _GraphQLConfig and _Audience internal classes through the generic REST API routes /classes/_GraphQLConfig and /classes/_Audience without requiring master key authentication.

This flaw bypasses the master key enforcement that exists on the dedicated /graphql-config and /push_audiences endpoints, effectively exposing sensitive configuration and audience data to unauthenticated attackers.

Critical Impact

An attacker can read, modify, and delete GraphQL configuration and push audience data without authentication, potentially compromising application integrity and enabling further attacks on dependent systems.

Affected Products

• Parse Server versions prior to 8.6.25 (stable branch)
• Parse Server versions prior to 9.5.2-alpha.12 (alpha branch)
• All Parse Server 9.5.2 alpha versions from alpha1 through alpha11

Discovery Timeline

• 2026-03-10 - CVE-2026-31800 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-31800

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when a software component fails to perform authorization checks when an actor attempts to access a resource or perform an action. In this case, Parse Server exposes internal classes through generic REST API routes without enforcing the same authentication requirements applied to their dedicated endpoints.

The root issue lies in an inconsistency between how Parse Server handles authentication for internal classes. While the dedicated endpoints /graphql-config and /push_audiences properly require master key authentication, the generic class routes /classes/_GraphQLConfig and /classes/_Audience do not inherit or enforce these same restrictions. This creates an authentication bypass where attackers can access the same underlying data through an alternative, unprotected path.

Root Cause

The vulnerability stems from incomplete authorization enforcement across Parse Server's REST API architecture. Internal classes prefixed with underscore (_GraphQLConfig, _Audience) were not properly protected when accessed through the generic /classes/ route pattern. The authorization middleware that validates master key requirements on dedicated endpoints was not consistently applied to the generic class access pattern, creating a security gap.

Attack Vector

The attack can be executed remotely over the network with low complexity. An unauthenticated attacker can directly access the vulnerable endpoints without any user interaction requirements. The exploitation path involves:

1. Identifying a Parse Server instance exposed to the network
2. Sending HTTP requests to /classes/_GraphQLConfig or /classes/_Audience endpoints
3. Reading, modifying, or deleting sensitive configuration data without providing master key credentials

The vulnerability can be exploited through simple HTTP requests to the REST API endpoints. An attacker targeting a Parse Server instance would send GET, PUT, or DELETE requests to the /classes/_GraphQLConfig or /classes/_Audience endpoints. Without proper authentication enforcement, these requests would be processed as if they came from an authorized user, allowing full CRUD operations on the internal class data.

For detailed technical information, see the GitHub Security Advisory GHSA-7xg7-rqf6-pw6c.

Detection Methods for CVE-2026-31800

Indicators of Compromise

• Unexpected HTTP requests to /classes/_GraphQLConfig or /classes/_Audience endpoints without master key headers
• Unauthorized modifications to GraphQL configuration settings
• Anomalous changes to push audience data or configurations
• Access logs showing unauthenticated requests to internal class endpoints

Detection Strategies

• Monitor Parse Server access logs for requests targeting _GraphQLConfig and _Audience class routes
• Implement alerting for any requests to internal class endpoints that lack proper master key authentication headers
• Review audit logs for unexpected changes to GraphQL configuration or push audience records
• Deploy web application firewall (WAF) rules to detect and alert on access patterns targeting internal classes

Monitoring Recommendations

• Enable detailed request logging on Parse Server instances to capture all API access attempts
• Configure SIEM rules to correlate unauthenticated access attempts to internal class endpoints
• Implement baseline monitoring for GraphQL configuration changes and alert on deviations
• Regularly audit Parse Server configurations and compare against known-good states

How to Mitigate CVE-2026-31800

Immediate Actions Required

• Upgrade Parse Server to version 8.6.25 or later (stable branch)
• Upgrade Parse Server to version 9.5.2-alpha.12 or later (alpha branch)
• Audit existing GraphQL configuration and push audience data for unauthorized modifications
• Review access logs for evidence of exploitation attempts

Patch Information

Parse Platform has released security patches addressing this vulnerability:

• Stable Branch: Version 8.6.25
• Alpha Branch: Version 9.5.2-alpha.12

For complete details on the security fix and additional guidance, refer to the GitHub Security Advisory GHSA-7xg7-rqf6-pw6c.

Workarounds

• If immediate patching is not possible, implement network-level access controls to restrict access to the Parse Server API
• Configure a reverse proxy or WAF to block unauthenticated requests to /classes/_GraphQLConfig and /classes/_Audience endpoints
• Temporarily disable public access to the Parse Server instance until the patch can be applied
• Monitor and alert on any access attempts to internal class endpoints while awaiting upgrade

# Example nginx configuration to block access to internal classes
location ~ ^/parse/classes/_(?:GraphQLConfig|Audience) {
    # Only allow requests with valid master key header
    if ($http_x_parse_master_key = "") {
        return 403;
    }
    proxy_pass http://parse-server:1337;
}