parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

高 7.2CVE-2026-30229 · BIT-parse-2026-30229 · GHSA-79wj-8rqv-jvp5 · 06/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-30229 は parse-server (parseplatform), parse-server に影響する深刻度「高」 (CVSS 7.2) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.43%（全脆弱性の 37.1% より高い）。
対処：8.6.6, 9.5.0-alpha.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
parse-server parseplatform	`= 9.5.0≥ 9.0.0, ≤ 9.4.1< 8.6.6`	`8.6.6`
parse-server npm	`≥ 9.0.0, < 9.5.0-alpha.4< 8.6.6`	`9.5.0-alpha.48.6.6`

概要

Impact

The readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected.

Patches

The fix adds a check to the /logInAs handler.

Workarounds

There is no workaround other than not using readOnlyMasterKey.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-79wj-8rqv-jvp5
Fix for Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.4
Fix for Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.6

NVD の説明

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected. This issue has been patched in versions 8.6.6 and 9.5.0-alpha.4.