PT-2026-24689 · Bitnami+4 · Parse+1

Restriction · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-31872

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.6 Parse Server versions prior to 8.6.32

Description Parse Server is an open source backend deployable on Node.js infrastructures. A flaw exists in the class-level permission (CLP) feature, specifically with the protectedFields setting. An attacker can bypass this protection by utilizing dot-notation within query WHERE clauses and sort parameters. This allows querying or sorting by sub-fields of a protected field, potentially enabling a binary oracle attack to reveal values of those protected fields. This issue impacts both MongoDB and PostgreSQL deployments. The vulnerability is related to how query keys and sort keys are checked against protected fields, failing to extract the root field from dot-notation paths. For example, a query on secretObj.apiKey was not correctly blocked when secretObj was a protected field.

Recommendations Versions prior to 9.6.0-alpha.6 should be updated to version 9.6.0-alpha.6 or later. Versions prior to 8.6.32 should be updated to version 8.6.32 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-PARSE-2026-31872

CVE-2026-31872

GHSA-R2M8-PXM9-9C4G

Affected Products

Parse

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31872.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-r2m8-pxm9-9c4g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31872 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31872 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r2m8-pxm9-9c4g · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-31872 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.32 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.6 · Note
• https://reddit.com/r/VulnMatter/comments/1rqu37b/resumen_diario_de_vulnerabilidades_11032026 · Reddit Post
• https://twitter.com/CVEnew/status/2031992392526835783 · Twitter Post