CVE-2026-34373 json
Parse Server: GraphQL API endpoint ignores CORS origin restriction
published 2026-03-30 7 mo ago modified 2026-09-10 1 mo ago also BIT-parse-2026-34373 , EUVD-2026-17465 , GHSA-q3p6-g7c4-829c
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. This issue has been patched in versions 8.6.66 and 9.7.0-alpha.10.
Patch / fix
- npm parse-server 8.6.66, 9.7.0-alpha.10
- bitnami parse 8.6.66, 9.7.0
- parseplatform parse-server 8.6.66, 9.7.0-alpha.10
- parseplatform parse_server 8.6.66, 9.7.0-alpha.10
- github.com/parse-community/parse-server@0347641 commit
- github.com/parse-community/parse-server@4dd0d3d commit
- github.com/parse-community/parse-server#10334 pull request
- github.com/parse-community/parse-server#10335 pull request
- github.com/parse-community/parse-server/security/advisories/GHSA-q3p6… advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | parse-server | >=9.0.0, <9.7.0-alpha.10 >=3.5.0, <8.6.66 |
9.7.0-alpha.10 8.6.66 |
| bitnami | parse | <8.6.66 >=9.0.0, <9.7.0 |
8.6.66 9.7.0 |
Affected products
- parse-community parse-server
Classification
- Weakness
-
- CWE-346 Origin Validation Error
References
-
github.com
/parse-community/parse-server/pull/10334
web, issue-tracking, patch
-
github.com
/parse-community/parse-server/pull/10335
web, issue-tracking, patch
-
github.com
/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263
web, patch
-
github.com
/parse-community/parse-server/commit/4dd0d3d8be1c39664c74ad10bb0abaa76bc41203
web, patch
-
github.com
/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c
web, patch, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34373
advisory, web
-
github.com
/parse-community/parse-server
package
Sources
- CVE List CVE-2026-34373
- GitHub Advisory GHSA-q3p6-g7c4-829c
- NVD CVE-2026-34373
- OSV BIT-parse-2026-34373
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.