PT-2026-25985 · Unknown · Parse Server

Restriction · Published 2026-03-17 · Updated 2026-03-20 · CVE-2026-32878

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.20 Parse Server versions prior to 8.6.44

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is affected by an issue where an attacker can bypass request keyword denylist protection and class-level permissions for adding fields. This is achieved by sending a crafted request that exploits prototype pollution within the deep copy mechanism. Successful exploitation allows the injection of fields into class schemas with restricted field addition, potentially causing permanent schema type conflicts that cannot be resolved, even with master key access. The issue stems from parse-server’s reliance on a cloning mechanism that alters data before security checks, specifically the deep copy step stripping proto properties. The vulnerable third-party deep copy library was replaced with a built-in deep clone mechanism in newer versions.

Recommendations Parse Server versions prior to 9.6.0-alpha.20 should be updated to version 9.6.0-alpha.20 or later. Parse Server versions prior to 8.6.44 should be updated to version 8.6.44 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BIT-PARSE-2026-32878

CVE-2026-32878

GHSA-9CCR-FPP6-78QF

Affected Products

Parse Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32878.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-9ccr-fpp6-78qf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32878 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-32878 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9ccr-fpp6-78qf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32878 · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10201 · Note
• https://github.com/parse-community/parse-server/pull/10200 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/RedPacketSec/status/2034735868309610908 · Twitter Post
• https://twitter.com/NewsNerdie/status/2034540853746692521 · Twitter Post
• https://twitter.com/CVEnew/status/2034520417122075100 · Twitter Post