Title: parse-server de parse-community, Description: Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.70 y 9.7.0-alpha.18, un usuario autenticado con permiso de nivel de clase 'find' puede eludir la configuración de permiso de nivel de clase 'protectedFields' en las suscripciones de LiveQuery. Al enviar una suscripción con un valor de operador $or, $and o $nor como un objeto simple con claves numéricas y una propiedad 'length' (un objeto 'similar a un array') en lugar de un array, la protección del campo protegido es eludida. El disparo del evento de suscripción actúa como un oráculo binario, permitiendo al atacante inferir si un campo protegido coincide con un valor de prueba dado. Este problema ha sido parcheado en las versiones 8.6.70 y 9.7.0-alpha.18.

{"timestamp":"2026-03-31T17:22:23.778081Z","id":"CVE-2026-34595","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"parse-community","product":"parse-server","versions":[{"version":"< 8.6.70","status":"affected"},{"version":">= 9.0.0, < 9.7.0-alpha.18","status":"affected"}]}]

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

OR
          *cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* versions up to (excluding) 8.6.70
          *cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* versions from (including) 9.0.0 up to (excluding) 9.7.0
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha1:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha10:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha11:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha12:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha13:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha14:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha15:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha2:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha3:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha4:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha5:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha6:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha7:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha8:*:*:*:node.js:*:*
          *cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha9:*:*:*:node.js:*:*

GitHub, Inc.: https://github.com/parse-community/parse-server/commit/f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98 Types: Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2 Types: Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/pull/10350 Types: Issue Tracking, Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/pull/10351 Types: Issue Tracking, Patch

GitHub, Inc.: https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2 Types: Patch, Vendor Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value. This issue has been patched in versions 8.6.70 and 9.7.0-alpha.18.

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-843

https://github.com/parse-community/parse-server/commit/f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98

https://github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2

https://github.com/parse-community/parse-server/pull/10350

https://github.com/parse-community/parse-server/pull/10351

https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2