PT-2026-25374 · Unknown+1 · Parse Server+1

Fancymalware · Published 2026-03-13 · Updated 2026-03-20 · CVE-2026-32594

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.40 Parse Server versions prior to 9.6.0-alpha.14

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is affected by an issue in the GraphQL WebSocket endpoint for subscriptions. Prior to fixes, this endpoint did not enforce authentication, introspection control, or query complexity limits through the standard Express middleware chain. This allowed attackers to connect to the WebSocket endpoint and execute GraphQL operations without valid API keys, access the GraphQL schema even with public introspection disabled, and bypass query complexity limits by sending arbitrarily complex queries.

Recommendations Versions prior to 8.6.40 should be updated to version 8.6.40 or later. Versions prior to 9.6.0-alpha.14 should be updated to version 9.6.0-alpha.14 or later. Block WebSocket upgrade requests to the GraphQL subscriptions path (by default /subscriptions) at the network level, for example using a reverse proxy or load balancer rule.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-PARSE-2026-32594

CVE-2026-32594

GHSA-P2X3-8689-CWPG

Affected Products

Node.Js

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32594.json · Exploit
• https://github.com/parse-community/parse-server/pull/10190 · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-p2x3-8689-cwpg · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10189 · Patch
• https://osv.dev/vulnerability/CVE-2026-32594 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2x3-8689-cwpg · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-32594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32594 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/commit/21330d146c68b57a930a58b8a8cd9fbf09436cf3 · Note
• https://github.com/parse-community/parse-server/commit/3ffba757bfc836bd034e1369f4f64304e110e375 · Note
• https://twitter.com/CVEnew/status/2032605874485661967 · Twitter Post