Is CVE-2026-34532 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34532 being exploited in the wild.

How severe is CVE-2026-34532?

Critical severity, with a CVSS score of 9.1, published 31 March 2026.

Which products and versions are affected?

parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.7.0-alpha.11.

Is there a fix for CVE-2026-34532?

Yes. parse-server (npm): upgrade to 9.7.0-alpha.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34532 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34532?

Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34532: Parse Community Parse Server auth bypass in Cloud Functions

CVE-2026-34532 · Severity: critical · CVSS 9.1 · Published 2026-03-31

Parse Server is an open-source backend framework used to build and host applications. A security flaw allows unauthorized users to bypass security checks and run restricted functions by manipulating the web address used to call them. This could allow attackers to perform actions intended only for administrators or registered users, potentially leading to unauthorized data access or modification.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-34532 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34532 being exploited in the wild.
How severe is CVE-2026-34532?: Critical severity, with a CVSS score of 9.1, published 31 March 2026.
Which products and versions are affected?: parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.7.0-alpha.11.
Is there a fix for CVE-2026-34532?: Yes. parse-server (npm): upgrade to 9.7.0-alpha.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34532 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34532?: Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

parse-server (npm): upgrade to 9.7.0-alpha.11 or later
```
npm install parse-server@9.7.0-alpha.11
```

Technical details

A vulnerability in Parse Server's Cloud Function handling allows for an access control bypass via prototype chain traversal. When a Cloud Function is defined using the 'function' keyword and utilizes a plain object or arrow function as a validator, an attacker can append '.prototype.constructor' to the function name in the request URL. This causes the trigger store to resolve the handler through the prototype chain while the validator store fails to follow, resulting in the execution of the function without any validation (e.g., skipping requireUser or requireMaster checks). The issue is resolved in versions 8.6.67 and 9.7.0-alpha.11 by ensuring the trigger store verifies each node during traversal.

Affected products

Parse Community Parse Server < 8.6.67, >= 9.0.0 < 9.7.0-alpha.11

Identifiers

CVE-2026-34532
GHSA-vpj2-qq7w-5qq6

Timeline

2026-03-28: advisory: Vendor advisory published on GitHub
2026-03-28: patched: Fixes merged into release branches
2026-03-31: disclosed: CVE-2026-34532 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.