CVE-2026-121413
Awaiting Analysis Awaiting Analysis - Queue

Parse Server Authorization Bypass via Session Upgrade Endpoint

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121413
EUVD
EUVD-2026-115945

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse-community parse-server 9.0.0
parse-community parse-server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Parse Server before versions 8.6.112 and 9.0.0 before 9.10.6-alpha.4 has an authorization bypass in the session upgrade endpoint. Attackers with a valid session token can send it to /upgradeToRevocableSession to create new sessions without proper permission checks. These new sessions remain active even after the original session is logged out.

Impact Analysis

If you use a vulnerable Parse Server version, attackers could exploit this to maintain access to your account even after you log out. They could create persistent sessions using stolen or intercepted tokens, potentially leading to unauthorized actions or data access.

Compliance Impact

This vulnerability could violate data access controls required by GDPR and HIPAA. Unauthorized session persistence may lead to unauthorized data exposure or modification, breaching confidentiality and integrity requirements in these regulations.

Mitigation Strategies

Upgrade Parse Server to version 8.6.112 or later for the 8.x branch, or to 9.10.6-alpha.4 or later for the 9.x branch to address the authorization bypass in the session upgrade endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121413. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...