CVE-2026-33527

parseplatform parse-server

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-33527

Katalog CVE

CVSS 4.3 · Medium EPSS 0,34%

Kerentanan Incorrect Authorization pada parseplatform parse-server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.

Rincian

Terbit di NVD
24 Maret 2026
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-863: Incorrect Authorization
EPSS (30 hari)
0,34% peluang dieksploitasi; lebih tinggi dari 25,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
parseplatform parse-server Semua versi sebelum 8.6.57
parseplatform parse-server Versi 9.0.0 hingga sebelum 9.6.0
parseplatform parse-server Versi 9.6.0 alpha1
parseplatform parse-server Versi 9.6.0 alpha10
parseplatform parse-server Versi 9.6.0 alpha11
parseplatform parse-server Versi 9.6.0 alpha12
parseplatform parse-server Versi 9.6.0 alpha13
parseplatform parse-server Versi 9.6.0 alpha14
parseplatform parse-server Versi 9.6.0 alpha15
parseplatform parse-server Versi 9.6.0 alpha16
parseplatform parse-server Versi 9.6.0 alpha17
parseplatform parse-server Versi 9.6.0 alpha18
parseplatform parse-server Versi 9.6.0 alpha19
parseplatform parse-server Versi 9.6.0 alpha2
parseplatform parse-server Versi 9.6.0 alpha20
parseplatform parse-server Versi 9.6.0 alpha21
parseplatform parse-server Versi 9.6.0 alpha22
parseplatform parse-server Versi 9.6.0 alpha23
parseplatform parse-server Versi 9.6.0 alpha24
parseplatform parse-server Versi 9.6.0 alpha25
parseplatform parse-server Versi 9.6.0 alpha26
parseplatform parse-server Versi 9.6.0 alpha27
parseplatform parse-server Versi 9.6.0 alpha28
parseplatform parse-server Versi 9.6.0 alpha29
parseplatform parse-server Versi 9.6.0 alpha3
parseplatform parse-server Versi 9.6.0 alpha30
parseplatform parse-server Versi 9.6.0 alpha31
parseplatform parse-server Versi 9.6.0 alpha32
parseplatform parse-server Versi 9.6.0 alpha33
parseplatform parse-server Versi 9.6.0 alpha34
parseplatform parse-server Versi 9.6.0 alpha35
parseplatform parse-server Versi 9.6.0 alpha36
parseplatform parse-server Versi 9.6.0 alpha37
parseplatform parse-server Versi 9.6.0 alpha38
parseplatform parse-server Versi 9.6.0 alpha39
parseplatform parse-server Versi 9.6.0 alpha4
parseplatform parse-server Versi 9.6.0 alpha40
parseplatform parse-server Versi 9.6.0 alpha41
parseplatform parse-server Versi 9.6.0 alpha42
parseplatform parse-server Versi 9.6.0 alpha43
parseplatform parse-server Versi 9.6.0 alpha44
parseplatform parse-server Versi 9.6.0 alpha45
parseplatform parse-server Versi 9.6.0 alpha46
parseplatform parse-server Versi 9.6.0 alpha47
parseplatform parse-server Versi 9.6.0 alpha5
parseplatform parse-server Versi 9.6.0 alpha6
parseplatform parse-server Versi 9.6.0 alpha7
parseplatform parse-server Versi 9.6.0 alpha8
parseplatform parse-server Versi 9.6.0 alpha9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.