PT-2026-24482 · Unknown · Parse Server

0Xkakash1 · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-31828

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.13 Parse Server versions prior to 8.6.26

Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its LDAP authentication adapter. The issue stems from the direct interpolation of user-supplied input (authData.id) into LDAP Distinguished Names (DN) and group search filters without proper escaping of special characters. This allows an attacker with valid LDAP credentials to manipulate the bind DN structure and bypass group membership checks, potentially leading to privilege escalation from any authenticated LDAP user to a member of any restricted group. The vulnerability impacts Parse Server deployments utilizing the LDAP authentication adapter with group-based access control.

Recommendations Update to Parse Server version 9.5.2-alpha.13 or later. Update to Parse Server version 8.6.26 or later.

Exploit

Fix

LPE

Weakness Enumeration

CWE-90

Related Identifiers

BIT-PARSE-2026-31828

CVE-2026-31828

GHSA-7M6R-FHH7-R47C

Affected Products

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31828.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c · Patch
• https://osv.dev/vulnerability/BIT-parse-2026-31828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31828 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31828 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7m6r-fhh7-r47c · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.26 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.13 · Note
• https://t.me/cveNotify/155097 · Telegram Post
• https://t.me/CVEtracker/47034 · Telegram Post
• https://twitter.com/CVEnew/status/2031504068087099796 · Twitter Post