CVE-2026-112769 Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
Authenticated users can bypass class-level permissions to create unauthorized sessions and add fields, persisting access after logout.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-112769?
CVE-2026-112769 is a low-severity missing authorization vulnerability in parse-community parse-server, published on 19 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/_Session to create additional sessions for that user and add fields to _Session; these sessions are not revoked when the original session is logged out.
Weakness: CWE-863
Which versions are affected by CVE-2026-112769?
1 open source package ship an affected version, including parse.
| Package | Affected | Fixed in |
|---|---|---|
parse Bitnami | All versions | 8.6.98, 9.10.3 |
How do I fix CVE-2026-112769?
Upgrade parse to a fixed version for your release line: 8.6.98 or 9.10.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-112769 being exploited?
There is no known exploitation of CVE-2026-112769 in the wild and no public exploit code.
Sources
Also known as BIT-parse-2026-112769, GHSA-98wm-hr36-cp8m, GHSA-gj37-5hg5-p729.