{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-24T12:44:35.072","vulnerabilities":[{"cve":{"id":"CVE-2026-29182","sourceIdentifier":"security-advisories@github.com","published":"2026-03-06T21:16:15.137","lastModified":"2026-06-17T10:29:44.097","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some endpoints incorrectly accept the readOnlyMasterKey for mutating operations. This allows a caller who only holds the readOnlyMasterKey to create, modify, and delete Cloud Hooks and to start Cloud Jobs, which can be used for data exfiltration. Any Parse Server deployment that uses the readOnlyMasterKey option is affected. Note than an attacker needs to know the readOnlyMasterKey to exploit this vulnerability. This issue has been patched in versions 8.6.4 and 9.4.1-alpha.3."},{"lang":"es","value":"Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.4 y 9.4.1-alpha.3, la opción readOnlyMasterKey de Parse Server permite el acceso con privilegios de lectura a nivel maestro, pero está documentada para denegar todas las operaciones de escritura. Sin embargo, algunos endpoints aceptan incorrectamente la readOnlyMasterKey para operaciones de mutación. Esto permite a un llamador que solo posee la readOnlyMasterKey crear, modificar y eliminar Cloud Hooks e iniciar Cloud Jobs, lo que puede ser utilizado para la exfiltración de datos. Cualquier despliegue de Parse Server que utilice la opción readOnlyMasterKey se ve afectado. Tenga en cuenta que un atacante necesita conocer la readOnlyMasterKey para explotar esta vulnerabilidad. Este problema ha sido parcheado en las versiones 8.6.4 y 9.4.1-alpha.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"parse-community","product":"parse-server","versions":[{"version":"< 8.6.4","status":"affected"},{"version":"< 9.4.1-alpha.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-09T20:29:41.548934Z","id":"CVE-2026-29182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionEndExcluding":"8.6.4","matchCriteriaId":"41A471BF-7EE9-4E57-B9F6-1BDB37D27275"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionStartIncluding":"9.0.0","versionEndIncluding":"9.4.0","matchCriteriaId":"9FF0ADC7-6AA6-44F7-8CA9-E0A2F1C1D63A"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.4.1:alpha1:*:*:*:node.js:*:*","matchCriteriaId":"CC1C695A-70C0-45C8-867F-4541537F370B"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.4.1:alpha2:*:*:*:node.js:*:*","matchCriteriaId":"2B1E392B-A41C-460C-8811-AA0473393870"}]}]}],"references":[{"url":"https://github.com/parse-community/parse-server/releases/tag/8.6.4","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/9.4.1-alpha.3","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-vc89-5g3r-cmhh","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}