PT-2026-24750 · Bitnami+4 · Parse+1

Restriction · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-31856

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0 Parse Server versions prior to 8.6.29

Description Parse Server, an open-source backend deployable on Node.js infrastructures, contains a SQL injection issue within its PostgreSQL storage adapter. This occurs when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is directly inserted into SQL queries without proper parameterization or type validation. An attacker capable of sending write requests to the Parse Server REST API can inject arbitrary SQL subqueries, potentially reading any data from the database and bypassing Check Level Permissions (CLPs) and Access Control Lists (ACLs). Deployments utilizing MongoDB are not affected.

Recommendations For versions prior to 9.6.0, upgrade to version 9.6.0 or later. For versions prior to 8.6.29, upgrade to version 8.6.29 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PARSE-2026-31856

CVE-2026-31856

GHSA-Q3VJ-96H2-GWVG

Affected Products

Parse

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31856.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-q3vj-96h2-gwvg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q3vj-96h2-gwvg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31856 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31856 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-31856 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.29 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.3 · Note
• https://twitter.com/infoflowcloud/status/2031993962139886000 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031786984377589829 · Twitter Post
• https://twitter.com/CVEnew/status/2031992405709504794 · Twitter Post