En bref
- CVE-2026-39381 est une vulnérabilité MOYENNE (CVSS 4.3) touchant parse-server (parseplatform), parse-server.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.19%, plus élevée que 9.0% des vulnérabilités.
- Correctif : mettre à jour vers 9.8.0, 8.6.75, 9.8.0-alpha.7 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 9.8.0≥ 9.0.0, < 9.8.0< 8.6.75
| 9.8.08.6.75
|
| parse-server npm | ≥ 7.0.0, < 8.6.75≥ 9.0.0, < 9.8.0-alpha.7
| 8.6.759.8.0-alpha.7
|
Description
Impact
The GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields.
Patches
The GET /sessions/me handler now re-fetches the session with the caller's auth context after validating the session token, ensuring protectedFields and CLP apply consistently with other session endpoints.
Workarounds
None.
References
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields. This vulnerability is fixed in 9.8.0-alpha.7 and 8.6.75.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free