Auth bypass in Parse-community Parse-server

CVE-2026-39381

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured…

Vulnerability class: Broken Access Control

EPSS: 0.000 (8.5th percentile) — read the EPSS interpretation.

Affected products

Parse-community Parse-server — versions >= 9.0.0, < 9.8.0-alpha.7, >= 7.0.0, < 8.6.75

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64 (x_refsource_CONFIRM)
https://github.com/parse-community/parse-server/pull/10406 (x_refsource_MISC)
https://github.com/parse-community/parse-server/pull/10407 (x_refsource_MISC)