PT-2026-26166 · Unknown · Parse Server

Mtrezza · Publicado 2026-03-18 · Atualizado 2026-03-20 · CVE-2026-33163

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.35 Parse Server versions prior to 8.6.50

Description Parse Server is an open source backend deployable on Node.js infrastructures. When a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server unintentionally exposes protected fields and authData to all subscribers of that class. Class-Level Permissions (protectedFields) are not correctly enforced in LiveQuery event payloads for create, update, delete, enter, and leave events. Users with appropriate permissions can access sensitive data of other users, including personal information and OAuth tokens. This issue stems from a reference detachment bug where a JSON copy of the event object is created without the sensitive data filter applied. The fix ensures the filter operates on the data sent to clients.

Recommendations For versions prior to 9.6.0-alpha.35, remove all Parse.Cloud.afterLiveQueryEvent trigger registrations. For versions prior to 8.6.50, remove all Parse.Cloud.afterLiveQueryEvent trigger registrations.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-PARSE-2026-33163

CVE-2026-33163

GHSA-5HMJ-JCGP-6HFF

Produtos afetados

Parse Server

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33163.json · Exploit
• https://github.com/parse-community/parse-server/pull/10233 · Nota
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5hmj-jcgp-6hff · Aviso do Fabricante
• https://github.com/parse-community/parse-server/pull/10232 · Nota
• https://github.com/parse-community/parse-server · Nota
• https://twitter.com/CVEnew/status/2034520411778556115 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-5hmj-jcgp-6hff · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2026-33163 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33163 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33163 · Aviso do Fabricante