CVE-2026-34532: parse-server Cloud Function Validator Bypass Vulnerability
Summary
CVE-2026-34532: parse-server has cloud function validator bypass via prototype chain traversal. Affects parse-server across 2 version ranges.
< 8.6.67
>= 9.0.0, < 9.7.0-alpha.11
Fixed in 8.6.67 or 9.7.0-alpha.11, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-34532 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a scalable and flexible server-side architecture. It provides features such as data storage, user management, and cloud functions, allowing developers to execute custom logic on the server. However, a critical vulnerability has been identified that allows unauthorized access to protected cloud functions, potentially compromising application security.
Vulnerability Detail
The vulnerability arises from a flaw in the access control mechanism for Cloud Function validators in parse-server. An attacker can exploit this by appending '.prototype.constructor' to the function name in the URL, allowing them to bypass access controls meant to restrict function invocation. This issue occurs because the trigger store traversal resolves the handler through its prototype chain, while the validator store does not mirror this traversal, leading to a failure in enforcing access control. As a result, unauthenticated users can invoke sensitive Cloud Functions that should be protected by validators like 'requireUser' or 'requireMaster'.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.678.6.67npm install parse-server@8.6.67 -
>= 9.0.0, < 9.7.0-alpha.119.7.0-alpha.11npm install parse-server@9.7.0-alpha.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, use arrow functions instead of the 'function' keyword for Cloud Function handlers. Arrow functions do not have a prototype property and are not affected by this vulnerability. Example:
const myFunction = () => { /* function logic */ };
Conclusion
In summary, CVE-2026-34532 is a critical vulnerability in parse-server that allows unauthorized access to Cloud Functions due to a flaw in the validator access control mechanism. It is essential to update to the patched versions or implement workarounds to secure your application.
See every vulnerability recorded for parse-server →
FAQ
CVE-2026-34532 is a critical vulnerability in parse-server that allows attackers to bypass Cloud Function validators, potentially leading to unauthorized access to sensitive functions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow unauthorized users to invoke Cloud Functions that should be protected, leading to data breaches or unauthorized actions within the application.
If immediate updates are not possible, implement the suggested workaround by using arrow functions for Cloud Function handlers to mitigate the risk.
More information can be found in the GitHub security advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
