{"id":"GHSA-hwx8-q9cg-mqmc","summary":"Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization","details":"### Impact\n\nThe file metadata endpoint (GET `/files/:appId/metadata/:filename`) does not enforce `beforeFind` / `afterFind` file triggers. When these triggers are used as access-control gates, the metadata endpoint bypasses them entirely, allowing unauthorized access to file metadata.\n\nThis affects any deployment that relies on `Parse.Cloud.beforeFind(Parse.File, ...)` to restrict file access. Only file metadata (user-defined key-value pairs set via addMetadata) is exposed; file content remains protected.\n\n### Patches\n\nThe metadata handler now runs `beforeFind` and `afterFind` triggers and returns HTTP 403 when a trigger denies access.\n\n### Workarounds\n\nDisable the `metadata` endpoint by overriding the route with a middleware that rejects all requests:\n\n```js\n// Add before mounting Parse Server\napp.get('/parse/files/:appId/metadata/:filename', (req, res) =\u003e {\n  res.status(403).json({ error: 'Forbidden' });\n});\n```\n\nAdjust the path prefix (`/parse`) to match your mountPath.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.9\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.9","aliases":["BIT-parse-2026-30850","CVE-2026-30850"],"modified":"2026-03-16T03:03:37.622940Z","published":"2026-03-09T17:42:03Z","database_specific":{"nvd_published_at":"2026-03-07T17:15:52Z","cwe_ids":["CWE-862"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-03-09T17:42:03Z"},"references":[{"type":"WEB","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-hwx8-q9cg-mqmc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30850"},{"type":"PACKAGE","url":"https://github.com/parse-community/parse-server"}],"affected":[{"package":{"name":"parse-server","ecosystem":"npm","purl":"pkg:npm/parse-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.6.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hwx8-q9cg-mqmc/GHSA-hwx8-q9cg-mqmc.json"}},{"package":{"name":"parse-server","ecosystem":"npm","purl":"pkg:npm/parse-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0-alpha.1"},{"fixed":"9.5.0-alpha.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hwx8-q9cg-mqmc/GHSA-hwx8-q9cg-mqmc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}