PT-2026-27484 · Unknown+2 · Postgresql+3

Mtrezza · Published 2026-03-24 · Updated 2026-03-27 · CVE-2026-33539

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.59 Parse Server versions prior to 9.6.0-alpha.53

Description Parse Server, an open source backend deployable on Node.js infrastructure, contains a flaw where an attacker possessing master key access can execute arbitrary SQL statements on a PostgreSQL database. This is achieved by injecting SQL metacharacters into field name parameters within the aggregate $group pipeline stage or the distinct operation. Successful exploitation allows for privilege escalation, granting the attacker PostgreSQL database-level access from their existing Parse Server application-level administrator privileges. Deployments utilizing MongoDB are not impacted by this issue. The vulnerability stems from insufficient validation of field names in the aggregate $group. id object values and distinct dot-notation parameters, allowing for SQL injection through the :raw interpolation used in the PostgreSQL storage adapter.

Recommendations Upgrade to Parse Server version 8.6.59 or later. Upgrade to Parse Server version 9.6.0-alpha.53 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PARSE-2026-33539

CVE-2026-33539

GHSA-P2W6-RMH7-W8Q3

Affected Products

Mongodb

Node.Js

Parse Server

Postgresql

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33539.json · Exploit
• https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8c · Patch
• https://github.com/parse-community/parse-server/commit/bdddab5f8b61a40cb8fc62dd895887bdd2f3838e · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2w6-rmh7-w8q3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33539 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33539 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-33539 · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10273 · Note
• https://github.com/parse-community/parse-server/pull/10272 · Note
• https://github.com/parse-community/parse-server · Note