CVE-2026-31800: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31800 is a missing authorization vulnerability in Parse Server, an open-source Node.js backend platform, that allows unauthenticated attackers to read, modify, and delete GraphQL configuration and push audience data via generic REST API routes. The vulnerability affects Parse Server versions prior to 8.6.25 (8.x branch) and versions 9.0.0 through 9.5.2-alpha.11 (9.x branch). It was published by the GitHub Advisory Database on March 9, 2026, and assigned CVE ID on March 10, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.8 (High) (Github Advisory, Parse Server Advisory).

The root cause is CWE-862 (Missing Authorization): the _GraphQLConfig and _Audience internal classes were not included in the classesWithMasterOnlyAccess list, meaning the generic /classes/_GraphQLConfig and /classes/_Audience REST API routes did not enforce master key authentication. This inconsistency allowed the generic /classes/ routes to bypass the master key enforcement that was correctly applied to the dedicated /graphql-config and /push_audiences endpoints. An unauthenticated attacker with network access can send standard HTTP GET, PUT, or DELETE requests to these routes without any credentials, requiring no special tools or elevated privileges. The fix adds the affected internal classes to the classesWithMasterOnlyAccess list to enforce consistent access control (Parse Server Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to read sensitive GraphQL configuration data (potentially exposing schema details or internal API structure), modify GraphQL configurations to alter application behavior, and delete or tamper with push notification audience data, disrupting push campaigns. While there is no direct code execution or availability impact at the system level, the ability to silently modify backend configurations could enable persistent interference with application functionality and data integrity. The vulnerability requires no user interaction and can be exploited with low complexity from any network location (Github Advisory, Parse Server Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.106% (28th percentile), indicating a low near-term probability of exploitation. However, the attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable if a public-facing Parse Server instance is identified.

1. Reconnaissance: Identify internet-facing Parse Server instances using tools like Shodan or Censys by searching for known Parse Server HTTP response headers or default API paths (e.g., /parse/classes/).
2. Confirm vulnerability: Send a test HTTP GET request to /parse/classes/_GraphQLConfig or /parse/classes/_Audience without any authentication headers. A successful JSON response (HTTP 200) confirms the instance is vulnerable.
3. Read sensitive data: Issue an unauthenticated GET request to retrieve GraphQL configuration or push audience data:

   GET /parse/classes/_GraphQLConfig HTTP/1.1
   Host: <target>
   X-Parse-Application-Id: <app-id>

4. Modify configuration: Send an unauthenticated PUT or POST request to alter GraphQL schema settings or push audience definitions, potentially disrupting application behavior or redirecting push notifications.
5. Delete data: Issue an unauthenticated DELETE request to /parse/classes/_GraphQLConfig/<objectId> or /parse/classes/_Audience/<objectId> to remove configuration entries, causing service disruption. (Parse Server Advisory)

• Network: Unauthenticated HTTP GET, PUT, POST, or DELETE requests to /classes/_GraphQLConfig or /classes/_Audience REST API routes without a master key header (X-Parse-Master-Key).
• Logs: Parse Server access logs showing requests to /classes/_GraphQLConfig or /classes/_Audience from unexpected or external IP addresses, particularly without master key authentication; HTTP 200 responses to these routes from unauthenticated clients.
• Application Behavior: Unexpected changes to GraphQL schema configuration or push notification audience definitions; push notification campaigns targeting unintended audiences or failing unexpectedly.

Upgrade Parse Server to version 8.6.25 (for the 8.x branch) or 9.5.2-alpha.12 (for the 9.x branch) immediately, as these releases add _GraphQLConfig and _Audience to the classesWithMasterOnlyAccess list (Parse Server 8.6.25 Release, Parse Server 9.5.2-alpha.12 Release). There is no known configuration-based workaround; the vendor explicitly states no workaround exists (Github Advisory). As a compensating control until patching is possible, implement network-level access controls (e.g., firewall rules or API gateway policies) to restrict access to the /classes/ REST API endpoints to trusted IP ranges only, and monitor API logs for suspicious unauthenticated requests to the affected routes.

The vulnerability was reported by security researcher theinfosecguy and coordinated by Parse Server maintainer mtrezza, who published the advisory on March 9, 2026 (Parse Server Advisory). Community discussion was observed on Bluesky and security aggregator sites shortly after disclosure, with coverage appearing on CVE feed aggregators and vulnerability databases within hours of publication. No major media coverage or significant controversy has been noted.