PT-2026-29272 · Unknown · Parse Server

Bugbunny-Research · CVE-2026-34532 · Publicado 2026-03-31 · Atualizado 2026-07-24

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.67 Parse Server versions prior to 9.7.0-alpha.11

Description Parse Server is an open source backend deployable on Node.js infrastructures. An attacker can bypass Cloud Function validator access controls by appending prototype.constructor to the function name in the URL. This occurs when a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function. The trigger store traversal resolves the handler through its prototype chain, while the validator store does not mirror this traversal, effectively skipping all access control enforcement. This allows unauthenticated callers to invoke Cloud Functions protected by validators like requireUser, requireMaster, or custom validation logic.

Recommendations Update Parse Server to version 8.6.67 or later. Update Parse Server to version 9.7.0-alpha.11 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BIT-PARSE-2026-34532

CVE-2026-34532

GHSA-VPJ2-QQ7W-5QQ6

Produtos afetados

Parse Server

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34532.json · Exploit
• https://github.com/parse-community/parse-server · Nota
• https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7 · Correção
• https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6 · Aviso do Fabricante
• https://github.com/parse-community/parse-server/commit/dc59e272665644083c5b7f6862d88ce1ef0b2674 · Correção
• https://github.com/parse-community/parse-server/pull/10342 · Correção
• https://github.com/parse-community/parse-server/pull/10343 · Correção
• https://osv.dev/vulnerability/GHSA-vpj2-qq7w-5qq6 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2039013796128145667 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-34532 · Aviso do Fabricante
• https://t.me/cveNotify/221349 · Publicação no Telegram
• https://twitter.com/pulsepatchio/status/2039359743626547704 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-34532 · Nota de Segurança
• https://twitter.com/CVEnew/status/2039004428179509543 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2038993329388466225 · Publicação no Twitter