CVE-2026-30229: Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
Impact
The readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected.
Patches
The fix adds a check to the /logInAs handler.
Workarounds
There is no workaround other than not using readOnlyMasterKey.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-79wj-8rqv-jvp5 - Fix for Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.4 - Fix for Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.6
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected. This issue has been patched in versions 8.6.6 and 9.5.0-alpha.4.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30229?
CVE-2026-30229 has a high severity as it allows unauthorized access to user accounts through impersonation.
How do I fix CVE-2026-30229?
To fix CVE-2026-30229, upgrade Parse Server to version 9.5.0-alpha.4 or later, or to version 8.6.6.
What does CVE-2026-30229 exploit?
CVE-2026-30229 exploits the `/loginAs` endpoint, allowing `readOnlyMasterKey` to impersonate any user.
Which versions of Parse Server are affected by CVE-2026-30229?
Parse Server versions between 9.0.0 and 9.5.0-alpha.4 and any version up to 8.6.6 are affected by CVE-2026-30229.
How does the CVE-2026-30229 vulnerability impact user data?
CVE-2026-30229 allows full read and write access to user data through unauthorized user impersonation.