How to fix or mitigate CVE-2026-33421?

Within 24 hours: Inventory all systems running affected parse-server versions and identify classes using readUserFields or pointerFields CLP restrictions. Within 7 days: Apply the available vendor patch to all affected Parse Server instances and test in non-production environments first. Within 30 days: Conduct access logs review for potential unauthorized LiveQuery subscriptions and verify patch deployment across all environments.

CVE-2026-33421

Q: What is the CVSS score of CVE-2026-33421?

CVE-2026-33421 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Incorrect Authorization (CWE-863)

2026-03-20 https://github.com/parse-community/parse-server

GHSA-fph2-r4qg-9576

Information Disclosure Authentication Bypass

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 20:46 vuln.today

Patch released

Mar 20, 2026 - 20:46 nvd

Patch available

CVE Published

Mar 20, 2026 - 20:44 nvd

HIGH 7.1

DescriptionGitHub Advisory

Impact

Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and pointerFields). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user. This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is correctly restricted via the REST API.

Patches

The LiveQuery server now enforces pointer permissions on each event. After the existing check passes (which defers pointer permissions by design), the fix checks whether any configured pointer field on the object points to the subscribing user. Events for objects that don't match are silently skipped, consistent with how ACL mismatches are handled.

Workarounds

Use ACLs on individual objects to restrict read access instead of relying solely on CLP pointer permissions. ACLs are enforced by LiveQuery.

AnalysisAI

Parse Server's LiveQuery WebSocket interface contains an authorization bypass vulnerability that allows any authenticated user to subscribe to real-time object updates regardless of Class-Level Permission pointer field restrictions. Affected products include the parse-server npm package, where authenticated attackers can receive real-time updates for all objects in classes that should be restricted by readUserFields and pointerFields CLP settings, bypassing intended access controls that are correctly enforced in the REST API. No public proof-of-concept or active exploitation (KEV) has been reported at this time.

Technical ContextAI

Parse Server is a Node.js-based backend framework distributed via npm (pkg:npm/parse-server) that provides LiveQuery functionality for real-time WebSocket subscriptions to database changes. The vulnerability stems from CWE-863 (Incorrect Authorization), where the LiveQuery server fails to enforce Class-Level Permission pointer permissions that restrict read access based on whether pointer fields reference the requesting user. While the REST API correctly validates these pointer permissions (readUserFields and pointerFields), the LiveQuery WebSocket implementation defers this check and never performs the secondary validation to ensure pointer fields on objects point to the subscribing user, creating an authorization gap between the two interfaces.

RemediationAI

Apply the vendor-supplied patches available in GitHub pull requests #10250 and #10252 from the Parse Community repository (https://github.com/parse-community/parse-server/pull/10250 and https://github.com/parse-community/parse-server/pull/10252). The patches enforce pointer permission validation on each LiveQuery event by checking whether configured pointer fields point to the subscribing user. As a workaround until patching is completed, implement Access Control Lists (ACLs) on individual objects rather than relying solely on Class-Level Permission pointer fields, as ACLs are properly enforced by LiveQuery. Review the complete security advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-fph2-r4qg-9576 for additional implementation guidance.