Parse Platform parse-server 9.5.0 for Node.js
Approved changes feed: RSS · Atom
cpe:2.3:a:parseplatform:parse-server:9.5.0:-:*:*:*:node.js:*:*
part: a version: 9.5.0 update: -
| Vendor | Parseplatform (6383af77-895d-54d6-99f0-fd04347d92e2) |
|---|---|
| Product | Parse Server (63c30d4d-66ac-5ebe-9ef3-82524e7c616b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/parsecommunity/parseserver |
purl2cpe | 2026-06-01 10:16:40.301657 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-30850 |
vulnerable | 2026-06-08 07:57:14.372651 |
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata. This issue has been patched in versions 8.6.9 and 9.5.0-alpha.9.
Published: 2026-03-07T16:21:53.897Z
Updated: 2026-03-09T18:25:10.263Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.