CVE-2026-50008

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.8.0 through 9.9.1-alpha.3

Description The routeAllowList server option is intended to restrict external client access to a specific list of REST API routes. However, the check is only enforced as Express middleware against the outer HTTP request URL. Consequently, the '/batch' handler dispatches sub-requests to the internal router without re-evaluating the allow-list. This allows an external caller to bypass the operator-configured route firewall by issuing batch sub-requests to any REST API route omitted from the allow-list. Other authorization controls, such as Authentication, ACL, and CLP, remain active.

Recommendations Update to version 9.9.1-alpha.3.