Zaloguj się
Deutsch English Español Polski
Średnia

Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

  • Ujawniono: 01.04.2026
  • Aktualizacja: 11.10.2026 10:22

Impact

An authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value.

Patches

The fix validates that $or, $and, and $nor operator values are arrays in the LiveQuery subscription handler, the query depth checker, and the protected-field guard. As defense in depth, the LiveQuery query evaluator also rejects non-array values for these operators.

Workarounds

There is no known workaround.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka npm parse-server >= 9.0.0, < 9.7.0-alpha.16, < 8.6.70 9.7.0-alpha.16, 8.6.70

Odnośniki

Ocena CVSS -
Wektor CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Słabość (CWE)
CWE-843
Platforma
npm
Paczka
parse-server
Ujawniono
01.04.2026
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-mmg8-87c5-jrc2 - CC BY 4.0

Historia podatności: parse-server

Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (116) w archiwum
Wszystkich wpisów
116
Pierwsza → ostatnia
06.2019 06.2026
Bez poprawki
0
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 17
  • Wysoka 49
  • Średnia 40
  • Niska 10

Ujawnienia w latach

Istotność:
  1. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    Wysoka CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  2. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    Wysoka CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  3. Parser Server's streaming file download bypasses afterFind file trigger authorization
    Wysoka CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  4. Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value ten wpis
    Średnia CVE-2026-34595 >= 9.0.0, < 9.7.0-alpha.16, < 8.6.70 9.7.0-alpha.16, 8.6.70
  5. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    Wysoka CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  6. parse-server has cloud function validator bypass via prototype chain traversal
    Krytyczna CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  7. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    Wysoka CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  8. Parse Server exposes auth data via verify password endpoint
    Wysoka CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  9. Parse Server exposes auth data via /users/me endpoint
    Wysoka CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  10. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    Wysoka CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  11. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    Wysoka CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  12. Parse Server LiveQuery subscription query depth bypass
    Wysoka · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  13. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    Wysoka · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  14. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    Wysoka · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  15. Parse Server has an auth provider validation bypass on login via partial authData
    Wysoka · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  16. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    Wysoka CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  17. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    Wysoka CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  18. Parse Server crash via deeply nested query condition operators
    Wysoka CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  19. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    Wysoka CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  20. Parse Server: Account takeover via operator injection in authentication data identifier
    Krytyczna CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  21. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Krytyczna CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
  22. Parse Server's MFA recovery codes not consumed after use
    Wysoka CVE-2026-31875 >= 9.0.0-alpha.1, < 9.6.0-alpha.7, < 8.6.33 9.6.0-alpha.7, 8.6.33
  23. Parse Server has a protected fields bypass via dot-notation in query and sort
    Wysoka CVE-2026-31872 >= 9.0.0-alpha.1, < 9.6.0-alpha.6, < 8.6.32 9.6.0-alpha.6, 8.6.32
  24. Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
    Krytyczna CVE-2026-31871 >= 9.0.0-alpha.1, < 9.6.0-alpha.5, < 8.6.31 9.6.0-alpha.5, 8.6.31
  25. Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
    Krytyczna CVE-2026-31856 >= 9.0.0-alpha.1, < 9.6.0-alpha.3, < 8.6.29 9.6.0-alpha.3, 8.6.29
  26. Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
    Wysoka CVE-2026-31800 >= 9.0.0-alpha.1, < 9.5.2-alpha.12, < 8.6.25 9.5.2-alpha.12, 8.6.25
  27. Parse Server OAuth2 authentication adapter account takeover via identity spoofing
    Wysoka CVE-2026-30967 >= 9.0.0-alpha.1, < 9.5.2-alpha.9, < 8.6.22 9.5.2-alpha.9, 8.6.22
  28. Parse Server has role escalation and CLP bypass via direct `_Join` table write
    Krytyczna · 10.0 CVE-2026-30966 >= 9.0.0-alpha.1, < 9.5.2-alpha.7, < 8.6.20 9.5.2-alpha.7, 8.6.20
  29. Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
    Krytyczna CVE-2026-30965 >= 9.0.0-alpha.1, < 9.5.2-alpha.8, < 8.6.21 9.5.2-alpha.8, 8.6.21
  30. Parse Server has a protected fields bypass via logical query operators
    Wysoka CVE-2026-30962 >= 9.0.0, < 9.5.2-alpha.6, < 8.6.19 9.5.2-alpha.6, 8.6.19
  31. Parse Server missing audience validation in Keycloak authentication adapter
    Wysoka CVE-2026-30949 >= 9.0.0, < 9.5.2-alpha.5, < 8.6.18 9.5.2-alpha.5, 8.6.18
  32. Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
    Wysoka CVE-2026-30948 >= 9.0.0, < 9.5.2-alpha.4, < 8.6.17 9.5.2-alpha.4, 8.6.17
  33. Parse Server has a bypass of class-level permissions in LiveQuery
    Wysoka CVE-2026-30947 >= 9.0.0, < 9.5.2-alpha.3, < 8.6.16 9.5.2-alpha.3, 8.6.16
  34. Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    Wysoka CVE-2026-30946 < 8.6.15, >= 9.0.0, < 9.5.2-alpha.2 8.6.15, 9.5.2-alpha.2
  35. Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
    Wysoka CVE-2026-30941 >= 9.0.0, < 9.5.2-alpha.1, < 8.6.14 9.5.2-alpha.1, 8.6.14
  36. Parse Server: SQL injection via dot-notation field name in PostgreSQL
    Krytyczna CVE-2026-31840 >= 9.0.0, < 9.6.0-alpha.2, < 8.6.28 9.6.0-alpha.2, 8.6.28
  37. Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
    Wysoka CVE-2026-30939 < 8.6.13, >= 9.0.0-alpha.1, < 9.5.1-alpha.2 8.6.13, 9.5.1-alpha.2
  38. Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
    Wysoka CVE-2026-30925 >= 9.0.0-alpha.1, < 9.5.0-alpha.14, < 8.6.11 9.5.0-alpha.14, 8.6.11
  39. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
    Krytyczna CVE-2026-30863 >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 9.5.0-alpha.11, 8.6.10
  40. parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
    Wysoka CVE-2026-30229 < 8.6.6, >= 9.0.0, < 9.5.0-alpha.4 8.6.6, 9.5.0-alpha.4
  41. Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
    Wysoka CVE-2026-29182 >= 9.0.0, < 9.4.1-alpha.3, < 8.6.4 9.4.1-alpha.3, 8.6.4
  42. Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
    Krytyczna CVE-2026-27804 >= 9.0.0, < 9.3.1-alpha.4, < 8.6.3 9.3.1-alpha.4, 8.6.3
  43. Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
    Wysoka CVE-2025-68150 >= 9.0.0, < 9.1.1-alpha.1, < 8.6.2 9.1.1-alpha.1, 8.6.2
  44. Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
    Wysoka · 7.5 CVE-2025-64430 >= 4.2.0, < 7.5.4, >= 8.0.0, < 8.4.0-alpha.2 7.5.4, 8.4.0-alpha.2
  45. Parse Server's custom object ID allows to acquire role privileges
    Wysoka · 8.1 CVE-2024-47183 < 6.5.9, >= 7.0.0, < 7.3.0 6.5.9, 7.3.0
  46. ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
    Krytyczna · 9.8 CVE-2024-39309 < 6.5.7, >= 7.0.0, < 7.1.0 6.5.7, 7.1.0
  47. Server crashes on invalid Cloud Function or Cloud Job name
    Krytyczna · 9.0 CVE-2024-29027 < 6.5.5, >= 7.0.0-alpha.1, < 7.0.0-alpha.29 6.5.5, 7.0.0-alpha.29
  48. ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
    Krytyczna · 10.0 CVE-2024-27298 < 6.5.0, >= 7.0.0-alpha.1, < 7.0.0-alpha.20 6.5.0, 7.0.0-alpha.20
  49. Parse Server may crash when uploading file without extension
    Wysoka · 7.5 CVE-2023-46119 >= 1.0.0, < 5.5.6, >= 6.0.0, < 6.3.1 5.5.6, 6.3.1
  50. Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
    Wysoka · 7.5 CVE-2023-41058 >= 1.0.0, < 5.5.5, >= 6.0.0, < 6.2.2 5.5.5, 6.2.2
  51. Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
    Krytyczna · 9.8 CVE-2023-36475 < 5.5.2, >= 6.0.0, < 6.2.1 5.5.2, 6.2.1
  52. Parse Server option `masterKeyIps` vulnerability to IP spoofing
    Wysoka · 8.7 CVE-2023-22474 < 5.4.1 5.4.1
  53. Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
    Wysoka · 7.2 CVE-2022-41879 < 4.10.20, >= 5.0.0, < 5.3.3 4.10.20, 5.3.3
  54. Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers
    Wysoka · 7.2 CVE-2022-41878 < 4.10.19, >= 5.0.0, < 5.3.2 4.10.19, 5.3.2
  55. Remote code execution via MongoDB BSON parser through prototype pollution
    Krytyczna · 9.8 CVE-2022-39396 < 4.10.18, >= 5.0.0, < 5.3.1 4.10.18, 5.3.1
  56. parse-server crashes when receiving file download request with invalid byte range
    Wysoka · 7.5 CVE-2022-39313 < 4.10.17, >= 5.0.0, < 5.2.8 4.10.17, 5.2.8
  57. Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
    Wysoka · 8.6 CVE-2022-36079 < 4.10.14, >= 5.0.0, < 5.2.5 4.10.14, 5.2.5
  58. Protected fields exposed via LiveQuery
    Wysoka · 8.2 CVE-2022-31112 < 4.10.13, >= 5.0.0, < 5.2.4 4.10.13, 5.2.4
  59. Invalid file request can crash server
    Wysoka · 7.5 CVE-2022-31089 < 4.10.12, >= 5.0.0, < 5.2.3 4.10.12, 5.2.3
  60. Authentication bypass vulnerability in Apple Game Center auth adapter
    Wysoka · 8.6 CVE-2022-31083 < 4.10.11, >= 5.0.0, < 5.2.2 4.10.11, 5.2.2
Pokaż więcej (7) Widać 60 z 67

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.