EUVD-2026-17473
GHSA-vpj2-qq7w-5qq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped. This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic. This issue has been patched in versions 8.6.67 and 9.7.0-alpha.11.
AnalysisAI
Parse Server Cloud Function validator bypass allows unauthenticated remote attackers to execute protected server-side functions by exploiting prototype chain traversal. Attackers append 'prototype.constructor' to Cloud Function URLs to circumvent access controls (requireUser, requireMaster, custom validators), enabling unauthorized execution of backend business logic. Affects Parse Server versions prior to 8.6.67 and 9.7.0-alpha.11. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity (CVSS:4.0 AV:N/AC:L/PR:N). The vulnerability stems from inconsistent prototype chain resolution between handler and validator stores (CWE-863: Incorrect Authorization).
Technical ContextAI
Parse Server is a Node.js-based open-source backend framework (parse-community/parse-server) that provides cloud functions for executing server-side logic. The vulnerability arises from a prototype chain traversal inconsistency in how Cloud Function handlers and validators are resolved from their respective stores. When developers declare handlers using the function keyword (as opposed to arrow functions or other patterns) and attach validators as plain objects or arrow functions, the trigger store correctly resolves the handler by walking up JavaScript's prototype chain. However, the validator store fails to perform equivalent prototype chain traversal. This asymmetry allows attackers to reference handlers through prototype properties (e.g., appending '.prototype.constructor' to function names in HTTP requests) that exist in the handler resolution path but bypass the validator lookup entirely. The root cause is CWE-863 (Incorrect Authorization), where access control checks are structurally decoupled from the protected resource resolution mechanism, creating an exploitable gap in enforcement.
RemediationAI
Upgrade Parse Server immediately to version 8.6.67 (for production 8.x deployments) or 9.7.0-alpha.11 (for users tracking development builds). Vendor-released patches are available via GitHub commits 4fc48cf28f22eea200d74d883505f485234a48d7 (8.x branch) and dc59e272665644083c5b7f6862d88ce1ef0b2674 (9.x branch), implemented through pull requests 10342 and 10343. The fixes enforce consistent prototype chain handling between validator and handler resolution mechanisms. Update package dependencies using npm (npm install parse-server@8.6.67) or yarn, then restart Parse Server instances. Review Cloud Function implementations to identify functions using function keyword declarations with object-based validators, as these represent the vulnerable configuration pattern. No effective workarounds exist short of refactoring all protected Cloud Functions to use alternative declaration patterns or removing validator-based access controls in favor of inline authorization checks, which is impractical for most deployments. Consult the GitHub Security Advisory (GHSA-vpj2-qq7w-5qq6) at https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6 for additional context and vendor recommendations.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today