CVE-2026-34532: Parse Server Auth Bypass Vulnerability

CVE-2026-34532 Overview

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, contains a critical authorization bypass vulnerability that allows attackers to circumvent Cloud Function validator access controls. By appending prototype.constructor to the function name in the URL, unauthenticated callers can invoke Cloud Functions that should be protected by validators such as requireUser, requireMaster, or custom validation logic.

Critical Impact

This authorization bypass vulnerability allows unauthenticated attackers to invoke protected Cloud Functions, potentially leading to unauthorized data access, privilege escalation, and complete compromise of backend application logic.

Affected Products

• Parse Server versions prior to 8.6.67
• Parse Server versions 9.7.0-alpha1 through 9.7.0-alpha10
• All Parse Server deployments using Cloud Functions with validators declared as plain objects or arrow functions

Discovery Timeline

• 2026-03-31 - CVE-2026-34532 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34532

Vulnerability Analysis

This vulnerability exploits a fundamental inconsistency in how Parse Server's trigger store handles function resolution versus validator resolution. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain. However, the validator store fails to mirror this traversal behavior, creating a critical disconnect between handler execution and access control enforcement.

The exploitation leverages JavaScript's prototype chain mechanics, specifically targeting the prototype.constructor property that exists on all JavaScript objects. By manipulating the URL path to include this property reference, attackers can traverse the prototype chain to reach the function handler while the validator lookup fails silently, resulting in complete bypass of all configured access controls.

Root Cause

The root cause is classified as CWE-863 (Incorrect Authorization). The vulnerability stems from an asymmetric implementation in the store traversal logic within src/triggers.js. The handler resolution follows the prototype chain to locate Cloud Functions, but the parallel validator resolution does not implement equivalent prototype chain checking. This creates a security gap where malicious requests can reach protected handlers without triggering any validator logic.

The vulnerable code path failed to verify that intermediate store objects were actual data containers rather than inherited prototype properties, allowing attackers to escape the intended data structure through JavaScript's object inheritance mechanism.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by crafting HTTP requests to the Parse Server API endpoint with a modified function name that includes prototype.constructor in the path. This causes the server to:

1. Traverse the prototype chain when resolving the function handler
2. Fail to find a matching validator in the parallel validator store
3. Execute the protected Cloud Function without any access control checks

// Security patch in src/triggers.js
// Source: https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7
     return createStore();
   }
   store = store[component];
-    if (!store) {
+    if (!store || Object.getPrototypeOf(store) !== null) {
     return createStore();
   }
 }

The patch adds a critical check using Object.getPrototypeOf(store) !== null to ensure the traversed object is a genuine store container (created with Object.create(null)) rather than an inherited prototype property.

Detection Methods for CVE-2026-34532

Indicators of Compromise

• HTTP requests to Cloud Function endpoints containing prototype.constructor, __proto__, or similar prototype chain manipulation strings in the URL path
• Successful Cloud Function invocations without corresponding authentication or authorization log entries
• Unusual patterns of API calls to protected Cloud Functions from unauthenticated sources
• Server logs showing function executions with missing or empty validator evaluation traces

Detection Strategies

• Implement Web Application Firewall (WAF) rules to block requests containing prototype.constructor, __proto__, or constructor.prototype in URL paths
• Enable verbose logging for Parse Server Cloud Function invocations and monitor for executions without validator triggers
• Deploy runtime application self-protection (RASP) to detect prototype pollution and prototype chain traversal attempts
• Use SentinelOne Singularity to monitor for anomalous Node.js process behavior and unauthorized function executions

Monitoring Recommendations

• Configure alerting for any API requests containing prototype-related keywords in request paths or parameters
• Monitor Cloud Function execution logs for patterns where validators should have fired but did not
• Establish baseline metrics for authenticated vs. unauthenticated Cloud Function calls and alert on anomalies
• Review Parse Server access logs periodically for reconnaissance patterns targeting function discovery

How to Mitigate CVE-2026-34532

Immediate Actions Required

• Upgrade Parse Server to version 8.6.67 or 9.7.0-alpha.11 immediately
• Review Cloud Function implementations to identify any that use the function keyword declaration with plain object or arrow function validators
• Implement network-level filtering to block requests containing prototype manipulation strings until patching is complete
• Audit recent logs for potential exploitation attempts before the patch was applied

Patch Information

Parse Platform has released security patches addressing this vulnerability. Organizations should upgrade to the fixed versions as soon as possible:

• Stable branch: Upgrade to version 8.6.67 or later - View Pull Request #10342
• Alpha branch: Upgrade to version 9.7.0-alpha.11 or later - View Pull Request #10343

The security fix is documented in GitHub Security Advisory GHSA-vpj2-qq7w-5qq6. Both patch commits implement prototype chain validation in the store traversal logic to prevent unauthorized access through prototype manipulation.

Workarounds

• Refactor Cloud Function validators from arrow functions or plain objects to traditional function declarations that bind to the same prototype scope
• Implement an application-level middleware that sanitizes and rejects any request URLs containing prototype-related strings
• Configure reverse proxy or load balancer rules to block requests with suspicious URL patterns before they reach Parse Server
• Temporarily disable or restrict access to sensitive Cloud Functions until the patch can be applied

# Configuration example - Nginx rule to block prototype manipulation attempts
location /parse/functions/ {
    if ($request_uri ~* "(prototype|__proto__|constructor)") {
        return 403;
    }
    proxy_pass http://parse-server:1337;
}