PT-2026-29335 · Unknown+2 · Parse Server+2

Offset · Published 2026-03-31 · Updated 2026-04-06 · CVE-2026-34784

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.71 and 9.7.1-alpha.1

Description Parse Server, an open source backend deployable on Node.js infrastructures, is affected by an issue where file downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators on storage adapters supporting streaming, such as the default GridFS adapter. This bypass allows access to files that should be protected by afterFind trigger authorization logic or built-in validators like requireUser.

Recommendations Update to Parse Server version 8.6.71 or later. Update to Parse Server version 9.7.1-alpha.1 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-PARSE-2026-34784

CVE-2026-34784

GHSA-HPM8-9QX6-JVWV

Affected Products

Gridfs

Node.Js

Parse Server

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34784.json · Exploit
• https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337 · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-hpm8-9qx6-jvwv · Vendor Advisory
• https://github.com/parse-community/parse-server/pull/10362 · Patch
• https://github.com/parse-community/parse-server/commit/a0b0c69fc44f87f80d793d257344e7dcbf676e22 · Patch
• https://github.com/parse-community/parse-server/pull/10361 · Patch
• https://osv.dev/vulnerability/CVE-2026-34784 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpm8-9qx6-jvwv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34784 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-34784 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/infoflowcloud/status/2039373865449595368 · Twitter Post
• https://twitter.com/CVEnew/status/2039372145717895303 · Twitter Post