PT-2026-26482 · Unknown · Parse Server

Fancymalware · Publicado 2026-03-19 · Atualizado 2026-03-27 · CVE-2026-33323

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.51 Parse Server versions prior to 9.6.0-alpha.40

Description Parse Server contains a flaw where the Pages route and legacy PublicAPI route for resending email verification links reveal different responses based on whether a username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing redirect targets. The emailVerifySuccessOnInvalidEmail configuration option, which is enabled by default and protects the API route, did not apply to these routes. The issue is addressed by ensuring these routes respect the emailVerifySuccessOnInvalidEmail option, redirecting to the success page regardless of the outcome when the option is set to true.

Recommendations Upgrade to Parse Server version 8.6.51 or later. Upgrade to Parse Server version 9.6.0-alpha.40 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-204

Identificadores relacionados

BIT-PARSE-2026-33323

CVE-2026-33323

GHSA-H29G-Q5C2-9H4F

Produtos afetados

Parse Server

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33323.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f · Aviso do Fabricante
• https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5 · Correção
• https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3 · Correção
• https://github.com/parse-community/parse-server/pull/10238 · Nota
• https://github.com/parse-community/parse-server/pull/10243 · Nota
• https://github.com/parse-community/parse-server · Nota
• https://osv.dev/vulnerability/GHSA-h29g-q5c2-9h4f · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33323 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2026-33323 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33323 · Nota de Segurança