PT-2026-26760 · Unknown · Parse Server

Restriction · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-33429

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.54 Parse Server versions prior to 9.6.0-alpha.43

Description Parse Server contains a flaw where an attacker can subscribe to LiveQuery using a watch parameter that targets a protected field. While the actual value of the protected field is removed from event payloads, the system reveals whether the field has been updated, creating a binary oracle. For boolean protected fields, the timing of these events can reveal the field’s value. The watch parameter is not validated against protected fields during subscription, allowing this information leakage. Master key connections are exempt from this issue.

Recommendations Update to Parse Server version 8.6.54 or later. Update to Parse Server version 9.6.0-alpha.43 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BIT-PARSE-2026-33429

CVE-2026-33429

GHSA-QPC3-FG4J-8HGM

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33429.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-qpc3-fg4j-8hgm · Vendor Advisory
• https://github.com/parse-community/parse-server/commit/c62eacaf38de86913f09240583448360b1cc8e67 · Patch
• https://github.com/parse-community/parse-server/commit/0c0a0a5a37ca821d2553119f2cb3be35322eda4b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33429 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33429 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qpc3-fg4j-8hgm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-33429 · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10253 · Note
• https://github.com/parse-community/parse-server/pull/10254 · Note
• https://github.com/parse-community/parse-server · Note