CVE-2026-30228: Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction
Impact
The readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey.
Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files.
Patches
The fix adds permission checks to both the file upload and file delete handlers.
Workarounds
There is no workaround other than not using readOnlyMasterKey, or restricting network access to the Files API endpoints.
References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-xfh7-phr7-gr2x - Fix for Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.3 - Fix for Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.5
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey. Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files. This issue has been patched in versions 8.6.5 and 9.5.0-alpha.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30228?
CVE-2026-30228 is considered a critical vulnerability due to its ability to bypass the read-only restriction of the `readOnlyMasterKey` and allowing unauthorized file operations.
How do I fix CVE-2026-30228?
To fix CVE-2026-30228, upgrade your Parse Server to version 8.6.5 or 9.5.0-alpha.3 or later.
What are the affected versions in CVE-2026-30228?
CVE-2026-30228 affects Parse Server versions below 8.6.5 and versions between 9.0.0 and 9.5.0-alpha.3.
What operations are compromised by CVE-2026-30228?
CVE-2026-30228 allows unauthorized file creation and deletion operations through the Files API.
Is there a known exploit for CVE-2026-30228?
There are no specific known public exploits for CVE-2026-30228 at this time, but the vulnerability poses a significant risk for existing deployments.