« Volver al listado

CVE-2026-33163

Estado: AnalizadaAlta (8.2)—

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to all subscribers of that class. Fields configured as protected via Class-Level Permissions (`protectedFields`) are included in LiveQuery event payloads for all event types (create, update, delete, enter, leave).

Leer descripción completaMostrar menos

Any user with sufficient CLP permissions to subscribe to the affected class can receive protected field data of other users, including sensitive personal information and OAuth tokens from third-party authentication providers. The vulnerability was caused by a reference detachment bug. When an `afterEvent` trigger is registered, the LiveQuery server converts the event object to a `Parse.Object` for the trigger, then creates a new JSON copy via `toJSONwithObjects()`. The sensitive data filter was applied to the `Parse.Object` reference, but the unfiltered JSON copy was sent to clients. The fix in versions 9.6.0-alpha.35 and 8.6.50 ensures that the JSON copy is assigned back to the response object before filtering, so the filter operates on the actual data sent to clients. As a workaround, remove all `Parse.Cloud.afterLiveQueryEvent` trigger registrations. Without an `afterEvent` trigger, the reference detachment does not occur and protected fields are correctly filtered.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Red sin autenticación (AV:N, PR:N) permite consultar LiveQuery; fuga de campos protegidos y authData (tokens OAuth) a suscriptores vía referencia JSON no filtrada.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementLimit Access to Resource Over NetworkFilter Network TrafficUpdate SoftwareActive Directory ConfigurationVulnerability Scanning

Tecnologías afectadas (1)

Parseplatform — Parse-server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33163",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33163",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-19T14:00:23.867731Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "parse-community",
          "product": "parse-server",
          "versions": [
            {
              "status": "affected",
              "version": ">= 9.0.0, < 9.6.0-alpha.35"
            },
            {
              "status": "affected",
              "version": "< 8.6.50"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-18T22:16:26.270",
  "references": [
    {
      "url": "https://github.com/parse-community/parse-server/pull/10232",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/pull/10233",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-5hmj-jcgp-6hff",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to all subscribers of that class. Fields configured as protected via Class-Level Permissions (`protectedFields`) are included in LiveQuery event payloads for all event types (create, update, delete, enter, leave). Any user with sufficient CLP permissions to subscribe to the affected class can receive protected field data of other users, including sensitive personal information and OAuth tokens from third-party authentication providers. The vulnerability was caused by a reference detachment bug. When an `afterEvent` trigger is registered, the LiveQuery server converts the event object to a `Parse.Object` for the trigger, then creates a new JSON copy via `toJSONwithObjects()`. The sensitive data filter was applied to the `Parse.Object` reference, but the unfiltered JSON copy was sent to clients. The fix in versions 9.6.0-alpha.35 and 8.6.50 ensures that the JSON copy is assigned back to the response object before filtering, so the filter operates on the actual data sent to clients. As a workaround, remove all `Parse.Cloud.afterLiveQueryEvent` trigger registrations. Without an `afterEvent` trigger, the reference detachment does not occur and protected fields are correctly filtered."
    },
    {
      "lang": "es",
      "value": "Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 9.6.0-alpha.35 y 8.6.50, cuando un disparador 'Parse.Cloud.afterLiveQueryEvent' se registra para una clase, el servidor LiveQuery filtra campos protegidos y 'authData' a todos los suscriptores de esa clase. Los campos configurados como protegidos a través de Permisos a Nivel de Clase ('protectedFields') se incluyen en las cargas útiles de eventos de LiveQuery para todos los tipos de eventos (crear, actualizar, eliminar, entrar, salir). Cualquier usuario con permisos CLP suficientes para suscribirse a la clase afectada puede recibir datos de campos protegidos de otros usuarios, incluyendo información personal sensible y tokens OAuth de proveedores de autenticación de terceros. La vulnerabilidad fue causada por un error de desvinculación de referencia. Cuando un disparador 'afterEvent' se registra, el servidor LiveQuery convierte el objeto de evento en un 'Parse.Object' para el disparador, luego crea una nueva copia JSON a través de 'toJSONwithObjects()'. El filtro de datos sensibles se aplicó a la referencia de 'Parse.Object', pero la copia JSON sin filtrar fue enviada a los clientes. La corrección en las versiones 9.6.0-alpha.35 y 8.6.50 asegura que la copia JSON se reasigne al objeto de respuesta antes de filtrar, de modo que el filtro opera sobre los datos reales enviados a los clientes. Como solución alternativa, elimine todos los registros de disparadores 'Parse.Cloud.afterLiveQueryEvent'. Sin un disparador 'afterEvent', la desvinculación de referencia no ocurre y los campos protegidos se filtran correctamente."
    }
  ],
  "lastModified": "2026-06-17T10:37:03.473",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9E8CF62-B899-419B-AC14-C0C208455A4D",
              "versionEndExcluding": "8.6.50"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BAC01F8-0899-482C-8D91-64671BF2859A",
              "versionEndExcluding": "9.6.0",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBED261F-CA1B-44BC-9C3A-37378590EFEE"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "418338C9-6AEC-492C-ACA4-9B3C0AAE149C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "808B6482-BF8E-407D-8462-E757657CC323"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B84C28F8-AADE-41BB-A0EF-B701AB57DC3A"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7567BB81-7837-4265-B792-6A9B73CECF93"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0035C6F1-21B9-42D1-BE29-690905F3558C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "623FB30A-0693-4449-80FA-16D36B1BE66C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B420167-CD3E-45A7-AD9A-0F83AEC634BA"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "030A8626-DBBD-4BF2-B362-79B44FB1204D"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D38CFCC3-2AA9-4C8E-9064-FE97E6E8C45C"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65BB78F2-3A1A-4CD1-B8A8-4AB043B5CA50"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDC98AF7-8620-4A25-9BE5-623672599677"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23E28E0F-9379-4628-B9DC-8C94A45902CF"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6631BE51-74FB-40C0-9E91-0EDF2DCADD7A"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B0E4254-14A3-4EB6-9E98-CF45EB08B17F"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FF63FDE-75F5-44B6-A958-CF653D84D3B4"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "252B812D-A162-41C1-91CD-08D0CBAC5C46"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "421691EA-F55A-4738-8ABD-74B53B6DF155"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E7FAB59-142E-4191-9A6F-0744D810CD81"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B010F310-05A1-48AE-B002-8F4C7FA62EB3"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D3B2C32-16D8-415B-A49F-060ECE8F0F33"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43BE83C2-C756-4A5A-A340-B7D1FB52078D"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF340605-8CC8-4543-9F5D-E8602D258CED"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "702EBB22-3E9F-4CBE-B855-2E3642C530B1"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C17AD66-684F-4662-AF16-838FF05F47D5"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13C25963-CAE7-49AA-A941-254DCE289E35"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6BF0C2F-DD2B-4864-961F-CA808EF22633"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FBB21E9-CB73-4CB1-841A-D1C08167DB51"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A052DFCA-EDCC-43D7-82C7-E5311F6F7687"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12B11714-B961-4330-B241-FC5AF94FDBE8"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37A7C42B-4986-4BB6-BB27-0324A9AA1CFF"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C793834B-64B4-4DE9-BD7D-79B52C30C34E"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AD455C8-88BE-4A0A-B33D-3A7811FFB753"
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26C475A2-997C-4C3A-8CB6-04AB3534BBC3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}