{"schema":"threatline.record/2","record":{"id":"GHSA-gj37-5hg5-p729","aliases":["GHSA-gj37-5hg5-p729"],"summary":"Session creation endpoint bypasses create and addField class-level permissions","details":"### Impact\r\n\r\nAn authenticated user can create a session for their own account even when the class-level permissions of the `_Session` class do not permit the user to create sessions, and can add new fields to the `_Session` class even when the class-level permissions do not permit adding fields. Depending on the Parse Server version, the token of the created session is returned in the response, or the request is rejected after the session has already been created. This allows a user, or anyone in possession of a user's session token, to create additional sessions for that user contrary to the class-level permissions of the deployment; such sessions are not revoked when the original session is logged out. Only deployments that restrict the create or add field class-level permission of the `_Session` class are affected.\r\n\r\n### Patches\r\n\r\nSession creation now enforces the create and add field class-level permissions of the `_Session` class, and validates the request with the permissions of the requesting user, before the session is created.\r\n\r\n### Workarounds\r\n\r\nNeither class-level permissions nor Cloud Code triggers can prevent this, as the `_Session` class only supports the `afterLogout` trigger. If clients do not need to create sessions, block client requests that create `_Session` objects before they reach Parse Server, which are REST API `POST` requests to `/sessions` and `/classes/_Session`, including as part of batch requests, and disable the GraphQL API create mutation of the `_Session` class with the GraphQL class configuration `mutation: { create: false }`.\r\n\r\n### References\r\n\r\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729\r\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10744\r\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10745","categories":["Unclassified"],"product":"parse-server","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729","source_modified_at":"2026-10-04T11:31:29Z","fetched_at":"2026-10-23T20:37:03.234832Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 9.0.0, < 9.10.3-alpha.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729","source_modified_at":"2026-10-04T11:31:29Z","fetched_at":"2026-10-23T20:37:03.234832Z","package":{"ecosystem":"npm","name":"parse-server"},"range":"< 8.6.98"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729","source_modified_at":"2026-10-04T11:31:29Z","fetched_at":"2026-10-23T20:37:03.234832Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"9.10.3-alpha.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729","source_modified_at":"2026-10-04T11:31:29Z","fetched_at":"2026-10-23T20:37:03.234832Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"8.6.98"}],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-04T11:31:29Z","modified_at":"2026-10-04T11:31:29Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729","fetched_at":"2026-10-23T20:37:03.234832Z","source_modified_at":"2026-10-04T11:31:29Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-04T11:31:29Z","content_hash":"118a35214b5020869a5208c6966cc4c5fde08087e4cc151df542f12f948c5d9c"}}