PT-2026-29165 · Unknown · Parse Server

Mtrezza · Publicado 2026-03-30 · Atualizado 2026-04-06 · CVE-2026-34363

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.65 Parse Server versions prior to 9.7.0-alpha.9

Description Parse Server, an open source backend deployable on Node.js infrastructures, is affected by an issue where sensitive data can leak to unauthorized clients or incomplete data can be received by authorized clients when multiple clients subscribe to the same class via LiveQuery. This occurs because event handlers process subscribers concurrently using shared mutable objects, and the sensitive data filter modifies these objects in-place. Additionally, modifications from one subscriber's afterEvent Cloud Code trigger can leak to other subscribers through the same shared mutable state. Any deployment utilizing LiveQuery with protected fields or afterEvent triggers is potentially affected.

Recommendations Parse Server versions prior to 8.6.65 should be updated to version 8.6.65 or later. Parse Server versions prior to 9.7.0-alpha.9 should be updated to version 9.7.0-alpha.9 or later.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

BIT-PARSE-2026-34363

CVE-2026-34363

GHSA-M983-V2FF-WQ65

Produtos afetados

Parse Server

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34363.json · Exploit
• https://github.com/parse-community/parse-server · Nota
• https://github.com/parse-community/parse-server/pull/10330 · Correção
• https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65 · Aviso do Fabricante
• https://github.com/parse-community/parse-server/commit/5834e29234593addaa0251a85f572ad4f376320b · Correção
• https://github.com/parse-community/parse-server/commit/776c71c3078e77d38c94937f463741793609d055 · Correção
• https://github.com/parse-community/parse-server/pull/10331 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-34363 · Nota de Segurança
• https://twitter.com/CVEnew/status/2039004431878926587 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2039013902285988033 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-parse-2026-34363 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-m983-v2ff-wq65 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34363 · Aviso do Fabricante