CVE-2026-50008
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Parse Server versions from 9.8.0 to before 9.9.1-alpha.3 have a vulnerability that allows bypassing the allowed API route list. External clients can issue sub-requests to routes not included in this list, creating a risk of unauthorized access.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive API routes, potentially leading to data leaks or other serious security incidents.
Recommendation
It is recommended to update Parse Server to version 9.9.1-alpha.3 or later to patch this vulnerability and review the configuration of the allowed route list.
Original NVD description (English source)
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the allow-list check. An external caller whose outer route matches batch can issue batch sub-requests to any REST API route that the operator omitted from the allow-list. Authentication, ACL, CLP, and other inner-route authorization controls still apply — only the operator-configured route firewall is bypassed. This issue has been patched in version 9.9.1-alpha.3.