CVE-2025-67727

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.

• CWE-94
• CWE-269

• https://github.com/parse-community/parse-server/commit/6b9f8963cc3debf59cd9c5dfc5422aff9404ce9dPatch
• https://github.com/parse-community/parse-server/commit/e3d27fea08c8d8bdd9770a689bc2d757cda48b66Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6w8g-mgvv-3fcjVendor Advisory

Published

Dec 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
• CVE-2025-67722FreePBX is an open-source web-based graphical user interface…7.8
• CVE-2025-67723Discourse is an open source discussion platform. Versions pr…5.4
• CVE-2025-67724Tornado is a Python web framework and asynchronous networkin…6.1
• CVE-2025-67725Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67726Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2025-67728Fireshare facilitates self-hosted media and link sharing. Ve…9.8
• CVE-2025-67729LMDeploy is a toolkit for compressing, deploying, and servin…8.8
• CVE-2025-6773A vulnerability was found in HKUDS LightRAG up to 1.3.8. It …5.3
• CVE-2025-67730Frappe Learning Management System (LMS) is a learning system…5.4
• CVE-2025-67731Servify Express is a Node.js package to start an Express ser…7.5
• CVE-2025-67732Dify is an open-source LLM app development platform. Prior t…6.5