CVE-2026-34595

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value. This issue has been patched in versions 8.6.70 and 9.7.0-alpha.18.

• CWE-843

• https://github.com/parse-community/parse-server/commit/f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98Patch
• https://github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2Patch
• https://github.com/parse-community/parse-server/pull/10350Issue Tracking, Patch
• https://github.com/parse-community/parse-server/pull/10351Issue Tracking, Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2Patch, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3459The Drag and Drop Multiple File Upload - Contact Form 7 plug…8.1
• CVE-2026-34590Postiz is an AI social media scheduling tool. Prior to versi…5.4
• CVE-2026-34591Poetry is a dependency manager for Python. From version 1.4.…6.5
• CVE-2026-34592Coolify is an open-source and self-hostable tool for managin…7.7
• CVE-2026-34593Ash Framework is a declarative, extensible framework for bui…7.5
• CVE-2026-34594Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34596Sandboxie-Plus is an open source sandbox-based isolation sof…7
• CVE-2026-34597Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34598YesWiki is a wiki system written in PHP. Prior to version 4.…6.1
• CVE-2026-34599Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-3460The REST API TO MiniProgram plugin for WordPress is vulnerab…5.3
• CVE-2026-34600Joplin is an open source note-taking and to-do application t…5.7