CVE-2026-34784 Details

A vulnerability in Parse Server prior to versions 8.6.71 and 9.7.1-alpha.1 allows HTTP Range requests to bypass the afterFind(Parse.File) trigger and its associated validators on storage adapters that support streaming, such as the default GridFS adapter. This flaw enables unauthorized access to files that should be protected by the afterFind trigger's authorization logic or built-in validators like requireUser. The issue arises because the afterFind trigger is not executed before processing Range requests, leaving a gap in file access control.

Users can update to Parse Server versions 8.6.71 or 9.7.1-alpha.1, where this vulnerability has been patched. Alternatively, as a temporary workaround, the beforeFind(Parse.File) trigger can be used for file access authorization, as it applies to all download methods, including streaming.