PT-2026-24817 · Bitnami+4 · Parse+1

Restriction · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-32098

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.9 Parse Server versions prior to 8.6.35

Description Parse Server is an open-source backend deployable on Node.js infrastructures. An attacker can exploit LiveQuery subscriptions to determine the values of protected fields without directly receiving them. This is achieved by subscribing with a WHERE clause referencing a protected field, including through dot-notation or $regex. Observing whether LiveQuery events are delivered for matching objects creates a boolean oracle that reveals protected field values. This issue impacts any class with both protectedFields configured in Class-Level Permissions and LiveQuery enabled. The attack leverages the LiveQuery functionality and the way subscriptions are handled when filtering data based on protected fields. The WHERE clause in the LiveQuery subscription is the key component used by the attacker.

Recommendations Versions prior to 9.6.0-alpha.9: Upgrade to version 9.6.0-alpha.9 or later. Versions prior to 8.6.35: Upgrade to version 8.6.35 or later. As a workaround, disable LiveQuery for classes that utilize protectedFields in their Class-Level Permissions. Alternatively, remove protectedFields from classes that require LiveQuery functionality.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-PARSE-2026-32098

CVE-2026-32098

GHSA-J7MM-F4RV-6Q6Q

Affected Products

Parse

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32098.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-j7mm-f4rv-6q6q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j7mm-f4rv-6q6q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32098 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-32098 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.35 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.9 · Note
• https://twitter.com/CVEnew/status/2031867663169851723 · Twitter Post