CVE-2026-121413Low· 3.1▾ SunlitParse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.
parse-server >= 9.0.0 < 9.10.6-alpha.4parse-server < 8.6.112Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112769Low· 2.3Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
CVE-2026-112768Medium· 6.9Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
CVE-2026-109302Low· 3.7Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query ca…
CVE-2026-34532Critical· 9.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js
CVE-2026-50008Mediumparse-server: Server option routeAllowList is bypassable through batch sub-requests
CVE-2026-123487High· 7.5Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex