CVE-2026-32248: Parseplatform Parse-server vulnerability (CVSS 9.8)

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user identifier (e.g. anonymous authentication). By sending a crafted login request, the attacker can cause the server to perform a pattern-matching query instead of an exact-match lookup, allowing the attacker to match an existing user and obtain a valid session token for that user's account. Both MongoDB and PostgreSQL database backends are affected. Any Parse Server deployment that allows anonymous authentication (enabled by default) is vulnerable. This vulnerability is fixed in 9.6.0-alpha.12 and 8.6.38.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Parseplatform Parse-server9.6.0 · ≥ 9.0.0 < 9.6.0 · < 8.6.38

Remediation

Fixed in

Parseplatform Parse-server≥ 9.6.0

Patch & vendor advisories

https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87

References

https://github.com/parse-community/parse-server/releases/tag/8.6.38Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87Vendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-32248 being actively exploited?

CVE-2026-32248 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.95%.

How severe is CVE-2026-32248?

CVE-2026-32248 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.95% probability of exploitation.

Which products are affected by CVE-2026-32248?

Affected products include Parseplatform Parse-server.

How do I fix CVE-2026-32248?

Upgrade affected software to a fixed version, for example Parseplatform Parse-server 9.6.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-32248 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo