CVE-2026-34373
published 2026-03-31CVE-2026-34373: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the…
PriorityP354high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.20%
10.2th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. This issue has been patched in versions 8.6.66 and 9.7.0-alpha.10.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.66 | 8.6.66 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 3.5.0 < 8.6.66 | 8.6.66 |
| parse-community | parse-server | >= 9.0.0 < 9.7.0-alpha.10 | 9.7.0-alpha.10 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 3.5.0 < 8.6.66 | 8.6.66 |
| parseplatform | parse-server | >= 9.0.0 < 9.7.0 | 9.7.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
GraphQL API endpoint ignores CORS origin restriction
osv·2026-03-30
CVE-2026-34373 [MEDIUM] GraphQL API endpoint ignores CORS origin restriction
GraphQL API endpoint ignores CORS origin restriction
### Impact
The GraphQL API endpoint does not respect the `allowOrigin` server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured `allowOrigin` restriction.
### Patches
The GraphQL API endpoint now uses the same CORS middleware as the REST API, ensuring the `allowOrigin` and `allowHeaders` server options are consistently enforced across all endpoints.
### Workarounds
There is no known workaround other than upgrading.
### Resources
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4
GHSA
GraphQL API endpoint ignores CORS origin restriction
ghsa·2026-03-30
CVE-2026-34373 [MEDIUM] CWE-346 GraphQL API endpoint ignores CORS origin restriction
GraphQL API endpoint ignores CORS origin restriction
### Impact
The GraphQL API endpoint does not respect the `allowOrigin` server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured `allowOrigin` restriction.
### Patches
The GraphQL API endpoint now uses the same CORS middleware as the REST API, ensuring the `allowOrigin` and `allowHeaders` server options are consistently enforced across all endpoints.
### Workarounds
There is no known workaround other than upgrading.
### Resources
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4
No detection rules found.
No public exploits indexed.
https://github.com/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263https://github.com/parse-community/parse-server/commit/4dd0d3d8be1c39664c74ad10bb0abaa76bc41203https://github.com/parse-community/parse-server/pull/10334https://github.com/parse-community/parse-server/pull/10335https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c
2026-03-31
Published