Riskcovery

CVE-2025-67727

Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

State
Published
Severity
6.9 Medium
Published
Dec 12, 2025
Updated
Dec 12, 2025
Reserved
Dec 10, 2025

Read the record on cve.org

Description

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')
  • CWE-269 Improper Privilege Management

Affected Products

ProductVersions
parse-serverparse-community
  • < 8.6.0-alpha.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.