CVE-2026-30228

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey. Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files. This issue has been patched in versions 8.6.5 and 9.5.0-alpha.3.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-302297.2Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-al CVE-2026-30238.8Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-CVE-2026-302307.5Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail e CVE-2026-302315.3Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and dir CVE-2026-302329.6Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.CVE-2026-302334.3OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allow CVE-2026-302346.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permi CVE-2026-302356.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation CVE-2026-302364.3OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor CVE-2026-302376.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is CVE-2026-302386.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is CVE-2026-302397.1OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were