CVE-2026-30229: parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

March 6, 2026

The readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary users with full read and write access to their data. Any Parse Server deployment that uses readOnlyMasterKey is affected.

References

github.com/advisories/GHSA-79wj-8rqv-jvp5
github.com/parse-community/parse-server
github.com/parse-community/parse-server/security/advisories/GHSA-79wj-8rqv-jvp5
nvd.nist.gov/vuln/detail/CVE-2026-30229

Code Behaviors & Features

Detect and mitigate CVE-2026-30229 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →