What’s Vulnerable › Vulnerabilities

CVE-2025-67727: Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-12 · updated 2026-10-07
• Weakness: CWE-94

Description

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.

Affected products

• parse-community parse-server: through 8.5.0; 8.6.0-alpha1

References

• https://github.com/parse-community/parse-server/commit/6b9f8963cc3debf59cd9c5dfc5422aff9404ce9d
• https://github.com/parse-community/parse-server/commit/e3d27fea08c8d8bdd9770a689bc2d757cda48b66
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6w8g-mgvv-3fcj

Get alerted when CVE-2025-67727 or the next vulnerability affects your stack