{"id":"CVE-2026-30850","aliases":["BIT-parse-2026-30850","GHSA-hwx8-q9cg-mqmc"],"url":"https://o3.security/vulnerability/CVE-2026-30850","summary":"Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization","details":"### Impact\n\nThe file metadata endpoint (GET `/files/:appId/metadata/:filename`) does not enforce `beforeFind` / `afterFind` file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata.\n\nThis affects any deployment that relies on `Parse.Cloud.beforeFind(Parse.File, ...)` to restrict file access. Only file metadata (user-defined key-value pairs set via addMetadata) is exposed; file content remains protected.\n\n### Patches\n\nThe metadata handler now runs `beforeFind` and `afterFind` triggers and returns HTTP 403 when a trigger denies access.\n\n### Workarounds\n\nDisable the `metadata` endpoint by overriding the route with a middleware that rejects all requests:\n\n```js\n// Add before mounting Parse Server\napp.get('/parse/files/:appId/metadata/:filename', (req, res) => {\n  res.status(403).json({ error: 'Forbidden' });\n});\n```\n\nAdjust the path prefix (`/parse`) to match your mountPath.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.9\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.9","published":"2026-03-07T16:21:53.897Z","modified":"2026-08-12T03:51:29.724071615Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"parse-server","fixedVersion":"8.6.9"},{"ecosystem":"npm","name":"parse-server","fixedVersion":"9.5.0-alpha.9"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30850.json"},{"type":"ADVISORY","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30850"},{"type":"PACKAGE","url":"https://github.com/parse-community/parse-server"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.724071615Z"}}