CVE-2026-33421

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and pointerFields). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user. This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is correctly restricted via the REST API. This issue has been patched in versions 8.6.53 and 9.6.0-alpha.42.

• CWE-863

• https://github.com/parse-community/parse-server/commit/6c3317aca6eb618ac48f999021ae3ef7766ad1eaPatch
• https://github.com/parse-community/parse-server/commit/976dad109f3fe3fbd0a3a35ef62e7a5d35eb0beePatch
• https://github.com/parse-community/parse-server/pull/10250Issue Tracking
• https://github.com/parse-community/parse-server/pull/10252Issue Tracking
• https://github.com/parse-community/parse-server/security/advisories/GHSA-fph2-r4qg-9576Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33416LIBPNG is a reference library for use in applications that r…7.5
• CVE-2026-33417Wallos is an open-source, self-hostable personal subscriptio…7.1
• CVE-2026-33418DiceBear is an avatar library for designers and developers. …7.5
• CVE-2026-33419MinIO is a high-performance object storage system. Prior to …7.5
• CVE-2026-3342An Out-of-bounds Write vulnerability in WatchGuard Fireware …7.2
• CVE-2026-33420Vaultwarden is a Bitwarden-compatible server written in Rust…5.3
• CVE-2026-33422Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33423Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33424Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-33425Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-33426Discourse is an open-source discussion platform. Prior to ve…3.8
• CVE-2026-33427Discourse is an open-source discussion platform. Prior to ve…7.5