CVE-2026-34595

Katalog CVE

CVSS 4.3 · Medium EPSS 0,43%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada parseplatform parse-server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value. This issue has been patched in versions 8.6.70 and 9.7.0-alpha.18.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2 patch · advisory vendor
• https://github.com/parse-community/parse-server/commit/f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98 patch
• https://github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2 patch
• https://github.com/parse-community/parse-server/pull/10350 issue tracking · patch
• https://github.com/parse-community/parse-server/pull/10351 issue tracking · patch