Executive brief
Parse Server is a backend-as-a-service platform that handles authentication for applications. The LDAP authentication adapter fails to sanitize user input when constructing LDAP directory queries, allowing attackers with valid credentials to bypass group membership checks and escalate their privileges to access restricted groups. This can lead to unauthorized access to resources intended only for specific user groups.
Technical details
The vulnerability is an LDAP injection (CWE-90) in the LDAP authentication adapter. User-supplied input (authData.id) is directly interpolated into LDAP Distinguished Names (DN) and group search filters without escaping special characters according to RFC 4514 and RFC 4515. An authenticated attacker with valid LDAP credentials can craft malicious input to manipulate DN structure and bypass group membership validation, enabling privilege escalation from any authenticated LDAP user to any restricted group. The attack requires valid LDAP credentials (low privilege) and network access to the Parse Server instance. Patches are available in Parse Server 8.6.26 and 9.5.2-alpha.13.
Affected products
- Parse Community Parse Server all versions prior to 8.6.26; 9.0.0-alpha.1 to 9.5.2-alpha.13
Timeline
- 2026-03-11: disclosed: Security advisory published
- 2026-03-10: patched: Patches released in Parse Server 8.6.26 and 9.5.2-alpha.13