CVE-2026-121413 in Parse Server
Summary
by MITRE • 11/03/2026
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
Parse Server versions prior to 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contain a critical authorization bypass vulnerability within its session management subsystem, specifically affecting the endpoint responsible for upgrading sessions to revocable status. This flaw stems from an insufficient enforcement of class-level permissions on the _Session class during the creation process initiated by this specific API call. In a properly secured implementation, any operation that creates or modifies objects in protected classes such as user sessions must strictly validate whether the requesting entity possesses the necessary privileges defined in the security schema. However, due to this oversight, the server fails to verify if the current session token has the authority to trigger the creation of new session records via this endpoint.
The technical mechanism of exploitation involves an attacker who already holds a valid user session token interacting with the /upgradeToRevocableSession API route. By submitting their existing revocable session token, the application erroneically generates and returns additional session tokens that are assigned fresh expiration times. This behavior effectively decouples the lifecycle of these newly minted sessions from the original authentication context. Consequently, even if the user logs out or invalidates the primary session through standard logout procedures, the supplementary sessions created via this bypass remain active and valid within the server's state management system.
From an operational impact perspective, this vulnerability allows for persistent unauthorized access to a victim's account data and resources. An attacker can maintain long-term access to sensitive information without needing to steal new credentials or exploit further authentication flaws. The ability to generate sessions with extended lifetimes undermines the fundamental security model of session-based authentication, where logout actions are expected to terminate all active privileges associated with that user identity. This persistence enables attackers to perform malicious activities under the victim's guise long after the initial compromise has been detected and mitigated by standard means.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-306, Missing Authentication for Critical Function, because the system fails to properly authenticate the requestor's right to perform a privileged operation (creating new sessions). In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1528, Steal Application Access Token, and potentially contributes to persistence mechanisms similar to T1078, Valid Accounts. The attacker leverages valid credentials but abuses the application logic to expand their access footprint beyond intended boundaries.
To mitigate this risk, organizations running affected versions of Parse Server must upgrade immediately to version 8.6.112 or later for the 8.x branch, or version 9.10.6-alpha.4 and above for the 9.x development line. These updates include patches that correctly enforce class-level permissions on session creation operations within the upgrade endpoint. Until an upgrade is feasible, administrators should consider implementing a Web Application Firewall rule to restrict access to the /upgradeToRevocableSession endpoint or monitor logs for anomalous patterns of session generation from single IP addresses or user agents. Regular auditing of session management configurations and ensuring that security schemas are strictly enforced during all object creation events are essential practices to prevent similar authorization bypasses in future deployments.