CVE-2026-31800 is a critical missing authorization flaw (CVSS 9.1) in Parse Server before 8.6.25 and 9.5.2-alpha.12. Internal classes could be read, changed and deleted through generic REST routes without the master key. Upgrade to 8.6.25 or 9.5.2-alpha.12.
What's affected
Parse Server versions before 8.6.25 on the 8.x line and before 9.5.2-alpha.12 on the 9.x line are affected.
The internal classes involved are _GraphQLConfig and _Audience.
How to check if you're exposed
Check your installed version:
npm ls parse-server
If you use the GraphQL configuration or push audiences, review those records for changes you did not make. The generic class routes are the path the record describes.
What to do now
- Upgrade to Parse Server 8.6.25 or 9.5.2-alpha.12 or later.
- Review _GraphQLConfig and _Audience data for unexpected edits or deletions.
- Put a proxy rule in front of the server to block direct access to internal class routes if you cannot upgrade yet.
- Keep the master key out of client code and rotate it if it may have leaked.
Why it matters
The weakness class is CWE-862, missing authorization. The dedicated /graphql-config and /push_audiences endpoints require the master key, but the generic /classes routes for the same data did not. Two doors led to the same room and only one was locked.
The record says an attacker can read, modify and delete GraphQL configuration and push audience data. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why was the dedicated endpoint safe but not the generic one?
Each route enforced its own checks. The generic class route did not apply the master key rule to these internal classes.
Is upgrading enough?
Upgrade, then review the affected data, since changes made before the fix are not undone.
Sources
- Parse Server security advisory GHSA-7xg7-rqf6-pw6c
- Parse Server 8.6.25 release
- NVD record for CVE-2026-31800
Last reviewed: 19 October 2026.
