PT-2026-26166 · Unknown · Parse Server

Mtrezza · Published 2026-03-18 · Updated 2026-03-20 · CVE-2026-33163

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.35 Parse Server versions prior to 8.6.50

Description Parse Server is an open source backend deployable on Node.js infrastructures. When a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server unintentionally exposes protected fields and authData to all subscribers of that class. Class-Level Permissions (protectedFields) are not correctly enforced in LiveQuery event payloads for create, update, delete, enter, and leave events. Users with appropriate permissions can access sensitive data of other users, including personal information and OAuth tokens. This issue stems from a reference detachment bug where a JSON copy of the event object is created without the sensitive data filter applied. The fix ensures the filter operates on the data sent to clients.

Recommendations For versions prior to 9.6.0-alpha.35, remove all Parse.Cloud.afterLiveQueryEvent trigger registrations. For versions prior to 8.6.50, remove all Parse.Cloud.afterLiveQueryEvent trigger registrations.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-PARSE-2026-33163

CVE-2026-33163

GHSA-5HMJ-JCGP-6HFF

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33163.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5hmj-jcgp-6hff · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hmj-jcgp-6hff · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-33163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33163 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33163 · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10233 · Note
• https://github.com/parse-community/parse-server/pull/10232 · Note
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2034520411778556115 · Twitter Post