CVE-2026-30228 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
The readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /files/:filename). This bypasses the read-only restriction which violates the access scope of the readOnlyMasterKey.
Any Parse Server deployment that uses readOnlyMasterKey and exposes the Files API is affected. An attacker with access to the readOnlyMasterKey can upload arbitrary files or delete existing files.
The fix adds permission checks to both the file upload and file delete handlers.
There is no workaround other than not using readOnlyMasterKey, or restricting network access to the Files API endpoints.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.