CVE-2026-39381: Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Impact
The GET /sessions/me endpoint returns Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields.
Patches
The GET /sessions/me handler now re-fetches the session with the caller's auth context after validating the session token, ensuring protectedFields and CLP apply consistently with other session endpoints.
Workarounds
None.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64 - Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10406 - Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10407
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields. This vulnerability is fixed in 9.8.0-alpha.7 and 8.6.75.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 8.6.75 - Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 9.8.0-alpha.7 - Upgrade
Upgrade
parse-serverto a version that resolves this vulnerability.Fixed in 9.8.0-alpha.7 - Upgrade
Upgrade
parse-serverto a version that resolves this vulnerability.Fixed in 8.6.75
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39381?
CVE-2026-39381 has a medium severity as it allows authenticated users to access protected fields in their session.
How do I fix CVE-2026-39381?
To fix CVE-2026-39381, upgrade to parse-server version 8.6.75 or 9.8.0-alpha.7 or later.
What type of vulnerability is CVE-2026-39381?
CVE-2026-39381 is an access control vulnerability affecting the '/sessions/me' endpoint.
Which versions are affected by CVE-2026-39381?
CVE-2026-39381 affects parse-server versions from 7.0.0 up to 8.6.75 and from 9.0.0 to 9.8.0-alpha.7.
Who is affected by CVE-2026-39381?
Any authenticated user utilizing the affected versions of parse-server can access their own protected session fields.