Is CVE-2026-31800 actively exploited?

No active exploitation of CVE-2026-31800 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-31800 be exploited remotely?

Yes. CVE-2026-31800 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-31800?

CVE-2026-31800 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-31800

CRITICAL

CVE-2026-31800

CWE-862Published: March 10, 2026· Updated: Mar 11, 2026

9.1

CVSS v3.1

EPSS:0.08%probability of exploitation in 30 daysPercentile:23.0th

Official Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the _GraphQLConfig and _Audience internal classes can be read, modified, and deleted via the generic /classes/_GraphQLConfig and /classes/_Audience REST API routes without master key authentication. This bypasses the master key enforcement that exists on the dedicated /graphql-config and /push_audiences endpoints. An attacker can read, modify and delete GraphQL configuration and push audience data. This vulnerability is fixed in 9.5.2-alpha.12 and 8.6.25.

NVD Source

Technical Analysis

CVE-2026-31800 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.