CVE-2026-31901

Katalog CVE

CVSS 5.3 · Medium EPSS 0,42%

Kerentanan Observable Response Discrepancy pada parseplatform parse-server. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to an existing user, is already verified, or does not exist. An attacker can send requests with different email addresses and observe the error codes to determine which email addresses are registered in the application. This is a user enumeration vulnerability that affects any Parse Server deployment with email verification enabled (verifyUserEmails: true). This vulnerability is fixed in 8.6.34 and 9.6.0-alpha.8.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 patch · advisory vendor
• https://github.com/parse-community/parse-server/releases/tag/8.6.34 product · release notes
• https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.8 product · release notes