PT-2026-26759 · Unknown · Parse Server

Restriction · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-33421

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.53 Parse Server versions prior to 9.6.0-alpha.42

Description Parse Server’s LiveQuery WebSocket interface did not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and pointerFields). Authenticated users could subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, even if the pointer fields did not point to the subscribing user. This bypassed intended read access control, potentially allowing unauthorized access to sensitive data. The issue affects the handling of pointer permissions within the LiveQuery functionality.

Recommendations Update to Parse Server version 8.6.53 or later. Update to Parse Server version 9.6.0-alpha.42 or later. As a workaround, use Access Control Lists (ACLs) on individual objects to restrict read access instead of relying solely on CLP pointer permissions.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-PARSE-2026-33421

CVE-2026-33421

GHSA-FPH2-R4QG-9576

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33421.json · Exploit
• https://github.com/parse-community/parse-server/commit/976dad109f3fe3fbd0a3a35ef62e7a5d35eb0bee · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-fph2-r4qg-9576 · Vendor Advisory
• https://github.com/parse-community/parse-server/commit/6c3317aca6eb618ac48f999021ae3ef7766ad1ea · Patch
• https://osv.dev/vulnerability/GHSA-fph2-r4qg-9576 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-33421 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33421 · Security Note
• https://github.com/parse-community/parse-server/pull/10252 · Note
• https://github.com/parse-community/parse-server/pull/10250 · Note
• https://github.com/parse-community/parse-server · Note