CVE-2026-30228: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30228 is an incorrect authorization vulnerability in Parse Server (an open-source Node.js backend) where the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename), bypassing its intended read-only restriction. It affects all Parse Server versions prior to 8.6.5 and versions 9.0.0 through 9.5.0-alpha.2 (inclusive). The vulnerability was disclosed on March 5, 2026, and patched the same day. It carries a CVSS v4.0 base score of 6.9 (Medium) and a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, Parse Server Advisory).

The root cause is CWE-863 (Incorrect Authorization): the file upload (POST /files/:filename) and file delete (DELETE /files/:filename) handlers in the Files API did not perform proper permission checks to enforce the read-only constraint of the readOnlyMasterKey. An attacker who possesses the readOnlyMasterKey — which is intended to grant only read access — can send authenticated HTTP requests to these endpoints to upload arbitrary files or delete existing ones. The fix adds explicit permission checks to both handlers to block write operations when the readOnlyMasterKey is used (Parse Server Advisory, GitHub Advisory).

Successful exploitation allows an attacker with access to the readOnlyMasterKey to upload arbitrary files to the server or delete existing files, resulting in a high integrity impact on the vulnerable system. There is no confidentiality or availability impact directly attributed to this vulnerability. The scope is limited to Parse Server deployments that both use readOnlyMasterKey and expose the Files API; however, the ability to upload arbitrary files could potentially be chained with other vulnerabilities for further compromise (Parse Server Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.015% (3rd percentile), indicating a low probability of exploitation in the near term. The vulnerability requires the attacker to already possess the readOnlyMasterKey, which limits the attack surface to insider threats or scenarios where the key has been leaked. It is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Obtain the readOnlyMasterKey: Acquire the readOnlyMasterKey through credential leakage, insider access, or exposure in configuration files or environment variables of the target Parse Server deployment.
2. Identify the Files API endpoint: Confirm the target Parse Server instance exposes the Files API (e.g., https://<parse-server-host>/parse/files/).
3. Upload an arbitrary file: Send an authenticated HTTP POST request to POST /files/:filename with the X-Parse-Master-Key header set to the readOnlyMasterKey and the file content in the request body:

   POST /parse/files/malicious.txt HTTP/1.1
   Host: <parse-server-host>
   X-Parse-Master-Key: <readOnlyMasterKey>
   Content-Type: text/plain
   
   <arbitrary file content>

4. Delete an existing file: Send an authenticated HTTP DELETE request to DELETE /files/:filename with the same readOnlyMasterKey header to remove a target file from the server.
5. Achieve objective: Use uploaded files for further exploitation (e.g., hosting malicious content) or disrupt application functionality by deleting critical files (Parse Server Advisory).

• Network: Unexpected POST or DELETE HTTP requests to /files/:filename endpoints authenticated with the readOnlyMasterKey (identifiable by the X-Parse-Master-Key header value matching the read-only key).
• Logs: Parse Server access logs showing file upload or deletion operations (POST /files/ or DELETE /files/) attributed to the readOnlyMasterKey rather than the full masterKey; unexpected file creation or deletion events in application logs.
• File System: Presence of unexpected or unknown files in the Parse Server file storage directory (local or cloud storage bucket) that were not created through normal application workflows; missing files that should exist based on application records.

Parse Server has released patched versions 8.6.5 (for the 8.x branch) and 9.5.0-alpha.3 (for the 9.x alpha branch), both released on March 5, 2026. Upgrading to one of these versions is the recommended remediation, as the fix adds proper permission checks to the file upload and delete handlers. If immediate upgrade is not possible, the only available workarounds are to stop using readOnlyMasterKey entirely or to restrict network access to the Files API endpoints (/files/:filename) via firewall rules or reverse proxy configuration (Parse Server Advisory, Release 8.6.5, Release 9.5.0-alpha.3).

The vulnerability was reported by security researcher devanshbatham and coordinated by mtrezza from the Parse community (GitHub Advisory). Coverage was picked up by several vulnerability tracking and security news outlets shortly after disclosure, including cvefeed.io, vuldb.com, and infinitsec.net. A blog post by the reporter (devansh.bearblog.dev) provided additional context on the discovery. The vulnerability was also covered in a video by undercodetesting.com as part of a broader discussion of CVE-2026-series Parse Server vulnerabilities.