Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…server/security/advisories/GHSA-2j2x-c587-q33g Üretici bülteni
• github.com/parse-community/parse-server/pull/10808 Yama
• github.com/parse-community/parse-server/pull/10809 Yama
• vulncheck.com/…ermission-bypass-via-upgradetorevocablesession Üçüncü taraf

Kayıt geçmişi

1. 3 Kas 2026 17:28Yayımlandı

İlgili açıklar

• 3,1 CVE-2026-122301Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
• 5,3 CVE-2026-121965Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key
• 3,7 CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
• 5,9 CVE-2026-121414Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
• 3,1 CVE-2026-120310Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
• 3,1 CVE-2026-119570Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses