8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31800

CVE-2026-31800: Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Impact

The _GraphQLConfig and _Audience internal classes can be read, modified, and deleted via the generic /classes/_GraphQLConfig and /classes/_Audience REST API routes without master key authentication. This bypasses the master key enforcement that exists on the dedicated /graphql-config and /push_audiences endpoints. An attacker can read, modify and delete GraphQL configuration and push audience data.

Patches

The fix adds the affected internal classes to the classesWithMasterOnlyAccess list, ensuring that the generic /classes/ routes enforce master key access consistently with the dedicated endpoints.

Workarounds

There is no known workaround.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.12
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.25

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31800

CVE-2026-31800:

8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0-alpha.1, < 9.5.2-alpha.12	9.5.2-alpha.12
parse-server	npm	< 8.6.25	8.6.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows unauthenticated users to perform CRUD operations on the internal _GraphQLConfig and _Audience classes via the generic /classes/ REST API endpoints. This bypasses the master key protection that is present on the dedicated /graphql-config and /push_audiences endpoints.

The root cause is that these two classes were missing from the classesWithMasterOnlyAccess list in src/SharedRest.js. This list is used by the generic REST handlers to determine if a master key is required for a given class.

The patch fixes this by adding _GraphQLConfig and _Audience to this list.

The vulnerable functions are the generic REST handlers that process requests for the /classes/:className endpoints. The test files (spec/rest.spec.js) show that these handlers are exposed as rest.create, rest.find, rest.update, and rest.del. When the vulnerability is exploited, one of these functions will be called to perform an unauthorized action on the _GraphQLConfig or _Audience classes. Therefore, these functions would appear in a runtime profile during exploitation.

Vulnerable functions

rest.create

src/SharedRest.js

This function handles the creation of objects via the generic `/classes/:className` REST endpoint. Before the patch, it did not require a master key to create objects in the `_Audience` class, because `_Audience` was not in the `classesWithMasterOnlyAccess` list in `src/SharedRest.js`. An attacker could use this to create malicious audience configurations.

rest.find

src/SharedRest.js

This function handles finding/querying objects via the generic `/classes/:className` REST endpoint. Before the patch, it did not require a master key to find objects in the `_GraphQLConfig` and `_Audience` classes. An attacker could use this to read sensitive GraphQL configuration and push audience data.

rest.update

src/SharedRest.js

This function handles updating objects via the generic `/classes/:className` REST endpoint. Before the patch, it did not require a master key to update objects in the `_GraphQLConfig` and `_Audience` classes. An attacker could use this to modify GraphQL configuration and push audience data.

rest.del

src/SharedRest.js

This function handles deleting objects via the generic `/classes/:className` REST endpoint. Before the patch, it did not require a master key to delete objects in the `_GraphQLConfig` and `_Audience` classes. An attacker could use this to delete GraphQL configuration and push audience data, causing a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.