Title: parse-server de parse-community, Description: Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.66 y 9.7.0-alpha.10, el endpoint de la API GraphQL no respeta la opción del servidor allowOrigin y permite incondicionalmente solicitudes de origen cruzado desde cualquier sitio web. Esto elude las restricciones de origen que los operadores configuran para controlar qué sitios web pueden interactuar con la API de Parse Server. La API REST aplica correctamente la restricción allowOrigin configurada. Este problema ha sido parcheado en las versiones 8.6.66 y 9.7.0-alpha.10.

{"timestamp":"2026-03-31T17:23:36.799171Z","id":"CVE-2026-34373","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"parse-community","product":"parse-server","versions":[{"version":"< 8.6.66","status":"affected"},{"version":">= 9.0.0, < 9.7.0-alpha.10","status":"affected"}]}]

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OR
          *cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* versions from (including) 9.0.0 up to (excluding) 9.7.0
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha1:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha2:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha3:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha4:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha5:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha6:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha7:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha8:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha9:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* versions from (including) 3.5.0 up to (excluding) 8.6.66

GitHub, Inc.: https://github.com/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263 Types: Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/commit/4dd0d3d8be1c39664c74ad10bb0abaa76bc41203 Types: Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/pull/10334 Types: Issue Tracking, Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/pull/10335 Types: Issue Tracking, Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c Types: Patch, Vendor Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. This issue has been patched in versions 8.6.66 and 9.7.0-alpha.10.

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-346

https://github.com/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263

https://github.com/parse-community/parse-server/commit/4dd0d3d8be1c39664c74ad10bb0abaa76bc41203

https://github.com/parse-community/parse-server/pull/10334

https://github.com/parse-community/parse-server/pull/10335

https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c