Executive brief
Parse Server is an open-source backend framework used to build and host applications. A security flaw allows unauthorized users to bypass security checks and run restricted functions by manipulating the web address used to call them. This could allow attackers to perform actions intended only for administrators or registered users, potentially leading to unauthorized data access or modification.
Technical details
A vulnerability in Parse Server's Cloud Function handling allows for an access control bypass via prototype chain traversal. When a Cloud Function is defined using the 'function' keyword and utilizes a plain object or arrow function as a validator, an attacker can append '.prototype.constructor' to the function name in the request URL. This causes the trigger store to resolve the handler through the prototype chain while the validator store fails to follow, resulting in the execution of the function without any validation (e.g., skipping requireUser or requireMaster checks). The issue is resolved in versions 8.6.67 and 9.7.0-alpha.11 by ensuring the trigger store verifies each node during traversal.
Affected products
- Parse Community Parse Server < 8.6.67, >= 9.0.0 < 9.7.0-alpha.11
Timeline
- 2026-03-28: advisory: Vendor advisory published on GitHub
- 2026-03-28: patched: Fixes merged into release branches
- 2026-03-31: disclosed: CVE-2026-34532 published
References
- https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7
- https://github.com/parse-community/parse-server/commit/dc59e272665644083c5b7f6862d88ce1ef0b2674
- https://github.com/parse-community/parse-server/pull/10342
- https://github.com/parse-community/parse-server/pull/10343
- https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6