{"action":"Upgrade parse-server to 8.6.75 or later.","affected":[{"fixed":"9.8.0-alpha.7","introduced":"9.0.0"},{"fixed":"8.6.75","introduced":"7.0.0"}],"component":"parse-server","cve_ids":["CVE-2026-39381"],"ecosystem":"npm","epss":0.002,"exploited":false,"fixed_versions":["9.8.0-alpha.7","8.6.75"],"ghsa_id":"GHSA-g4v2-qx3q-4p64","id":"tcs_01M5KFQ1VXBYRM3VKBB5C9SGE0","modified_at":"2026-04-15T21:35:50.168749Z","published_at":"2026-04-08T00:14:50Z","references":["https://osv.dev/vulnerability/GHSA-g4v2-qx3q-4p64","https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64","https://nvd.nist.gov/vuln/detail/CVE-2026-39381","https://github.com/parse-community/parse-server/pull/10406","https://github.com/parse-community/parse-server/pull/10407","https://github.com/parse-community/parse-server"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-g4v2-qx3q-4p64","url":"https://osv.dev/vulnerability/GHSA-g4v2-qx3q-4p64"}],"summary":"Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`"}