PT-2026-27482 · Unknown · Parse Server

Restriction · Publicado 2026-03-24 · Atualizado 2026-03-27 · CVE-2026-33527

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.57 Parse Server versions prior to 9.6.0-alpha.48

Description An authenticated user can modify server-generated session fields, such as expiresAt and createdWith, when updating their own session through the REST API. This bypasses the server’s session lifetime policy, potentially making a session permanent. The issue affects the ability to manage session duration, allowing for extended or indefinite session access.

Recommendations Upgrade to Parse Server version 8.6.57 or later. Upgrade to Parse Server version 9.6.0-alpha.48 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-PARSE-2026-33527

CVE-2026-33527

GHSA-JC39-686J-WP6Q

Produtos afetados

Parse Server

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33527.json · Exploit
• https://github.com/parse-community/parse-server/pull/10264 · Nota
• https://github.com/parse-community/parse-server/commit/ea68fc0b22a6056c9675149469ff57817f7cf984 · Correção
• https://github.com/parse-community/parse-server/commit/26b628c8fb3cc79ea955374769eebcff6f8a8a73 · Correção
• https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q · Aviso do Fabricante
• https://github.com/parse-community/parse-server/pull/10263 · Nota
• https://github.com/parse-community/parse-server · Nota
• https://osv.dev/vulnerability/CVE-2026-33527 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2026-33527 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33527 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-jc39-686j-wp6q · Aviso do Fabricante