PT-2026-29167 · Unknown · Parse Server

Mtrezza · Publicado 2026-03-30 · Atualizado 2026-04-06 · CVE-2026-34373

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.66 Parse Server versions prior to 9.7.0-alpha.10

Description Parse Server, an open source backend deployable on Node.js infrastructures, has an issue where the GraphQL API endpoint does not enforce the allowOrigin server option, unconditionally allowing cross-origin requests from any website. This bypasses origin restrictions configured by operators to control website interactions with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. The issue affects the ''/graphql'' API endpoint.

Recommendations Upgrade to Parse Server version 8.6.66 or later. Upgrade to Parse Server version 9.7.0-alpha.10 or later.

Exploit

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

BIT-PARSE-2026-34373

CVE-2026-34373

GHSA-Q3P6-G7C4-829C

Produtos afetados

Parse Server

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34373.json · Exploit
• https://github.com/parse-community/parse-server · Nota
• https://github.com/parse-community/parse-server/commit/4dd0d3d8be1c39664c74ad10bb0abaa76bc41203 · Correção
• https://github.com/parse-community/parse-server/pull/10334 · Correção
• https://github.com/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263 · Correção
• https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c · Aviso do Fabricante
• https://github.com/parse-community/parse-server/pull/10335 · Correção
• https://twitter.com/cyberbivash/status/2039013862989554176 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-34373 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-34373 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2026-34373 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-q3p6-g7c4-829c · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2039004430754783251 · Publicação no Twitter