CVE-2026-31800: Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
Impact
The GraphQLConfig and Audience internal classes can be read, modified, and deleted via the generic /classes/GraphQLConfig and /classes/Audience REST API routes without master key authentication. This bypasses the master key enforcement that exists on the dedicated /graphql-config and /pushaudiences endpoints. An attacker can read, modify and delete GraphQL configuration and push audience data.
Patches
The fix adds the affected internal classes to the classesWithMasterOnlyAccess list, ensuring that the generic /classes/ routes enforce master key access consistently with the dedicated endpoints.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.25
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the GraphQLConfig and Audience internal classes can be read, modified, and deleted via the generic /classes/GraphQLConfig and /classes/Audience REST API routes without master key authentication. This bypasses the master key enforcement that exists on the dedicated /graphql-config and /pushaudiences endpoints. An attacker can read, modify and delete GraphQL configuration and push audience data. This vulnerability is fixed in 9.5.2-alpha.12 and 8.6.25.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31800?
CVE-2026-31800 is considered a critical vulnerability due to its potential to allow unauthorized modifications to sensitive internal classes.
How do I fix CVE-2026-31800?
To fix CVE-2026-31800, upgrade your Parse Server to version 8.6.25 or 9.5.2-alpha.12 or later.
What systems are affected by CVE-2026-31800?
CVE-2026-31800 affects Parse Server versions up to 8.6.25 and versions between 9.0.0-alpha.1 to 9.5.2-alpha.12.
What components of Parse Server are vulnerable in CVE-2026-31800?
The vulnerable components in CVE-2026-31800 are the internal classes `_GraphQLConfig` and `_Audience' accessed via generic REST API routes.
Can CVE-2026-31800 lead to data loss or corruption?
Yes, CVE-2026-31800 can lead to data loss or corruption as it allows unauthorized users to modify or delete sensitive internal class data.