CVE-2026-34532 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped. This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic. This issue has been patched in versions 8.6.67 and 9.7.0-alpha.11.
A vulnerability in Parse Server allows attackers to bypass access controls on Cloud Function validators. This issue affects Parse Server versions prior to 8.6.67 and 9.0.0 through 9.7.0-alpha.11. The vulnerability arises when a Cloud Function handler is defined using the 'function' keyword, and its validator is a plain object or arrow function. In such cases, the trigger store traversal can be manipulated to skip access control enforcement, enabling unauthenticated users to invoke protected Cloud Functions. This vulnerability has been addressed in the latest releases of Parse Server.
Users can upgrade to Parse Server versions 8.6.67 or 9.7.0-alpha.11, where this vulnerability has been patched. Alternatively, for those using an affected version, a workaround is to use arrow functions for Cloud Function handlers, as they do not have a prototype property and are not susceptible to this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.67 >= 9.0.0, < 9.7.0 9.7.0 alpha1 9.7.0 alpha10 9.7.0 alpha2 9.7.0 alpha3 9.7.0 alpha4 9.7.0 alpha5 9.7.0 alpha6 9.7.0 alpha7 9.7.0 alpha8 9.7.0 alpha9 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |