CVE-2026-34532
published 2026-03-31CVE-2026-34532: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an…
PriorityP263critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.28%
19.4th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped. This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic. This issue has been patched in versions 8.6.67 and 9.7.0-alpha.11.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.67 | 8.6.67 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 8.6.67 | 8.6.67 |
| parse-community | parse-server | >= 9.0.0 < 9.7.0-alpha.11 | 9.7.0-alpha.11 |
| parseplatform | parse-server | < 8.6.67 | 8.6.67 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 9.0.0 < 9.7.0 | 9.7.0 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.1CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
parse-server has cloud function validator bypass via prototype chain traversal
ghsa·2026-03-31
CVE-2026-34532 [CRITICAL] CWE-863 parse-server has cloud function validator bypass via prototype chain traversal
parse-server has cloud function validator bypass via prototype chain traversal
### Impact
An attacker can bypass Cloud Function validator access controls by appending `.prototype.constructor` to the function name in the URL. When a Cloud Function handler is declared using the `function` keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped.
This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as `requireUser`, `requireMaster`, or custom validation logic.
### Patches
The trigger store traversal now verifies that each intermediate
OSV
parse-server has cloud function validator bypass via prototype chain traversal
osv·2026-03-31
CVE-2026-34532 [CRITICAL] parse-server has cloud function validator bypass via prototype chain traversal
parse-server has cloud function validator bypass via prototype chain traversal
### Impact
An attacker can bypass Cloud Function validator access controls by appending `.prototype.constructor` to the function name in the URL. When a Cloud Function handler is declared using the `function` keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped.
This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as `requireUser`, `requireMaster`, or custom validation logic.
### Patches
The trigger store traversal now verifies that each intermediate
No detection rules found.
No public exploits indexed.
https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7https://github.com/parse-community/parse-server/commit/dc59e272665644083c5b7f6862d88ce1ef0b2674https://github.com/parse-community/parse-server/pull/10342https://github.com/parse-community/parse-server/pull/10343https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
2026-03-31
Published