8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30229

CVE-2026-30229: Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected. This issue has been patched in versions 8.6.6 and 9.5.0-alpha.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30229

CVE-2026-30229:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	< 8.6.6	8.6.6
parse-server	npm	>= 9.0.0, < 9.5.0-alpha.4	9.5.0-alpha.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker with a readOnlyMasterKey to gain full read and write access by impersonating any user through the /loginAs endpoint. The analysis of the provided patches confirms this. The fix is located in the parse-community/parse-server repository, specifically in pull request #10099, which corresponds to commit de09d673d904b70e91cc2ef284184713d34170bf. The commit modifies src/Routers/UsersRouter.js by adding an authorization check within the handleLoginAs method. This method is the handler for the /loginAs route. The added code explicitly checks if the request is made using a read-only key (req.auth.isReadOnly) and, if so, denies the operation. This indicates that prior to the patch, handleLoginAs was the vulnerable function as it lacked this critical authorization check, leading to a privilege escalation vulnerability.

Vulnerable functions

UsersRouter.handleLoginAs

src/Routers/UsersRouter.js

The `handleLoginAs` function in `src/Routers/UsersRouter.js` is responsible for handling the `/loginAs` endpoint. Before the patch, this function checked if the request was made with a master key (`req.auth.isMaster`) but did not differentiate between a full-access master key and a read-only master key. This allowed a user with `readOnlyMasterKey` to call this endpoint and obtain a session token for any other user, effectively escalating their privileges to full read and write access. The patch introduces a check `if (req.auth.isReadOnly)` to explicitly block the read-only master key from using this functionality.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.