CVE-2025-64502

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0-alpha.5, Parse Server permits any client to execute explain queries without requiring the master key. This exposes database schema structure and field names, index configurations and query optimization details, query execution statistics and performance metrics, and potential attack vectors for database performance exploitation. In version 8.5.0-alpha.5, a new `databaseOptions.allowPublicExplain` configuration option has been introduced that allows to restrict `explain` queries to the master key. The option defaults to `true` for now to avoid a breaking change in production systems that depends on public `explain` availability. In addition, a security warning is logged when the option is not explicitly set, or set to `true`. In a future major release of Parse Server, the default will change to `false`. As a workaround, implement middleware to block explain queries from non-master-key requests, or monitor and alert on explain query usage in production environments.

• CWE-201

• https://github.com/parse-community/parse-server/commit/4456b02280c2d8dd58b7250e9e67f1a8647b3452
• https://github.com/parse-community/parse-server/pull/9890
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7cx5-254x-cgrq

Published

Nov 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64497Tuleap is an Open Source Suite for management of software de…6.5
• CVE-2025-64498Tuleap is an Open Source Suite for management of software de…4.3
• CVE-2025-64499Tuleap is a free and open source suite for management of sof…5.4
• CVE-2025-6450A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64500Symfony is a PHP framework for web and console applications …7.3
• CVE-2025-64501ProsemirrorToHtml is a JSON converter which takes ProseMirro…7.6
• CVE-2025-64503cups-filters contains backends, filters, and other software …3.3
• CVE-2025-64504Langfuse is an open source large language model engineering …5
• CVE-2025-64505LIBPNG is a reference library for use in applications that r…6.1
• CVE-2025-64506LIBPNG is a reference library for use in applications that r…6.1
• CVE-2025-64507Incus is a system container and virtual machine manager. An …7.8
• CVE-2025-64508Bugsink is a self-hosted error tracking tool. In versions pr…7.5