CVE-2026-33323

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Observable Response Discrepancy pada parseplatform parse-server. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whether the provided username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing different redirect targets. The existing emailVerifySuccessOnInvalidEmail configuration option, which is enabled by default and protects the API route against this, did not apply to these routes. This issue has been patched in versions 8.6.51 and 9.6.0-alpha.40.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f advisory vendor
• https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5 patch
• https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3 patch
• https://github.com/parse-community/parse-server/pull/10238 issue tracking
• https://github.com/parse-community/parse-server/pull/10243 issue tracking