Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-shyz-tw66-b3gv
Vulnerability ID VCID-shyz-tw66-b3gv
Aliases CVE-2026-30850
GHSA-hwx8-q9cg-mqmc
Summary Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization The file metadata endpoint (GET `/files/:appId/metadata/:filename`) does not enforce `beforeFind` / `afterFind` file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata. This affects any deployment that relies on `Parse.Cloud.beforeFind(Parse.File, ...)` to restrict file access. Only file metadata (user-defined key-value pairs set via addMetadata) is exposed; file content remains protected.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-862 Missing Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2026-30850
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2026-30850
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-hwx8-q9cg-mqmc
cvssv4 6.3 https://github.com/parse-community/parse-server
generic_textual MODERATE https://github.com/parse-community/parse-server
cvssv3.1_qr MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
cvssv4 6.3 https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
generic_textual MODERATE https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
cvssv4 6.3 https://nvd.nist.gov/vuln/detail/CVE-2026-30850
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-30850
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-30850
https://github.com/parse-community/parse-server
CVE-2026-30850 https://nvd.nist.gov/vuln/detail/CVE-2026-30850
GHSA-hwx8-q9cg-mqmc https://github.com/advisories/GHSA-hwx8-q9cg-mqmc
GHSA-hwx8-q9cg-mqmc https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-09T17:38:46Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-30850
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06171
EPSS Score 0.00021
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:51:27.256197+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/parse-server/CVE-2026-30850.yml 38.6.0