{"id":"EUVD-2026-36537","enisaUuid":"8d49f872-b271-37ef-940b-7588a3d61056","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the allow-list check. An external caller whose outer route matches batch can issue batch sub-requests to any REST API route that the operator omitted from the allow-list. Authentication, ACL, CLP, and other inner-route authorization controls still apply — only the operator-configured route firewall is bypassed. This issue has been patched in version 9.9.1-alpha.3.","datePublished":"Jun 12, 2026, 6:22:44 PM","dateUpdated":"Jun 12, 2026, 7:00:55 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-p84r-h6rx-f2xr\nhttps://github.com/parse-community/parse-server/pull/10482\n","aliases":"CVE-2026-50008\nGHSA-p84r-h6rx-f2xr\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"62dc0461-1a1a-316b-8b0a-bc636063a56f","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.8.0, \u003c 9.9.1-alpha.3"}],"enisaIdVendor":[{"id":"b14b6bf8-8df6-3745-a280-e640a1a1c8cf","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"33ab3ae4-8d2c-3df4-96ae-cd95de2b4b50","vulnerability":{"id":"CVE-2026-50008","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the allow-list check. An external caller whose outer route matches batch can issue batch sub-requests to any REST API route that the operator omitted from the allow-list. Authentication, ACL, CLP, and other inner-route authorization controls still apply — only the operator-configured route firewall is bypassed. This issue has been patched in version 9.9.1-alpha.3.","datePublished":"Jun 12, 2026, 6:22:44 PM","dateUpdated":"Jun 12, 2026, 7:00:55 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-p84r-h6rx-f2xr\nhttps://github.com/parse-community/parse-server/pull/10482\n","enisa_id":"EUVD-2026-36537\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Nov 1, 2026, 7:16:18 AM","vulnerabilityProduct":[{"id":"2a3a5177-7478-36f0-a52d-f1e25d5fd01b","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.8.0, \u003c 9.9.1-alpha.3"}],"vulnerabilityVendor":[{"id":"061c9312-a63b-30bf-8065-456919245e64","vendor":{"name":"parse-community"}}]}},{"id":"a600f019-b0dd-30a3-afd6-db2ac50d5aa6","vulnerability":{"id":"GHSA-p84r-h6rx-f2xr","description":"parse-server: Server option routeAllowList is bypassable through batch sub-requests","datePublished":"Jun 19, 2026, 7:34:41 PM","dateUpdated":"Jun 19, 2026, 7:34:41 PM","baseScore":0.0,"references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-p84r-h6rx-f2xr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50008\nhttps://github.com/parse-community/parse-server/pull/10482\nhttps://github.com/parse-community/parse-server\n","enisa_id":"EUVD-2026-36537\n","aliases":"CVE-2026-50008\nGHSA-p84r-h6rx-f2xr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}