CVE-2026-112769: Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/Session to create additional sessions for that user and add fields to Session; these sessions are not revoked when the original session is logged out.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to be authenticated as a user or possess a valid session token for that user. They can then send POST requests to /sessions or /classes/_Session.
What is the practical impact of the unauthorized sessions?
An attacker can create additional sessions for the affected user and add fields to the _Session class. Sessions created this way are not revoked when the original session is logged out.
Which deployments are affected?
Parse Server versions before 8.6.98 are affected, as are 9.x versions from 9.0.0 before 9.10.3-alpha.1. The issue concerns deployments relying on create and addField class-level permissions for _Session.