6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30228

CVE-2026-30228: Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey. Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files. This issue has been patched in versions 8.6.5 and 9.5.0-alpha.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30228

CVE-2026-30228:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.5.0-alpha.3	9.5.0-alpha.3
parse-server	npm	< 8.6.5	8.6.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the createHandler and deleteHandler methods in the FilesRouter class did not perform an authorization check to prevent write operations when the readOnlyMasterKey was used. The vulnerability description explicitly states that the readOnlyMasterKey could be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). The provided patches confirm this by adding a check if (req.auth.isReadOnly) at the beginning of both createHandler and deleteHandler in src/Routers/FilesRouter.js. This check now correctly denies access and returns a 403 Forbidden error if a write operation is attempted with the read-only key. Therefore, FilesRouter.createHandler and FilesRouter.deleteHandler are the vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

FilesRouter.createHandler

src/Routers/FilesRouter.js

This function handles file creation requests. Prior to the patch, it did not check if the request was made using the `readOnlyMasterKey`. This allowed an attacker with this key to bypass write restrictions and upload arbitrary files.

FilesRouter.deleteHandler

src/Routers/FilesRouter.js

This function handles file deletion requests. Prior to the patch, it did not check if the request was made using the `readOnlyMasterKey`. This allowed an attacker with this key to bypass write restrictions and delete existing files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.