CVE-2026-39381

OVERVIEW CVE-2026-39381 affects Parse Server, an open source backend platform deployable on Node.js infrastructure, in versions prior to 9.8.0-alpha.7 and 8.6.75. The vulnerability allows authenticated users to retrieve protected session fields through the GET /sessions/me endpoint that should be restricted by the server operator's protectedFields configuration. While equivalent endpoints correctly strip these fields, this single endpoint fails to enforce the protection mechanism, exposing potentially sensitive session data. SEVERITY The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM) with a network-based attack vector requiring low complexity and user authentication. The impact is limited to confidentiality, with no integrity or availability consequences. The authenticated requirement and limited scope restrict the threat profile, though the ease of exploitation via a single HTTP request presents a viable attack path for authorized users seeking unauthorized access to protected session information. EXPLOITATION STATUS There is no evidence of active exploitation, with an EPSS score of 0.000250 indicating minimal real-world prevalence. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on security watch lists. No public exploit code availability has been reported, and community attention remains low relative to the overall CVE landscape. Organizations should prioritize patching based on their Parse Server deployment footprint rather than immediate threat response.