CVE-2026-32742: parse-server · Mass Assignment
Affects parse-serverSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium : upgrade to 9.6.0-alpha.17 or 8.6.42 when convenient.
Data as of 31 Oct 2026, 08:20 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 9.6.0-alpha.17, 8.6.42
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 18 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Upgrade parse-server to 9.6.0-alpha.17 or 8.6.42; parse-community/parse-server to 8.6.42.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| parse-communityparse-server | Affected
| Fixed in
|
| parse-communityparse-server | Affected
| Fixed in
|
npmparse-community/parse-serverpkg:npm/parse-community/parse-serverOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Upgrade parse-server to version 9.6.0-alpha.17 or later, or 8.6.42 or later, where the vulnerability is fixed by filtering out server-generated session fields from user input.
- If immediate upgrade is not feasible, implement a beforeSave trigger on the _Session class to validate and reject or strip any user-supplied values for sessionToken, expiresAt, and createdWith fields, ensuring these cannot be overwritten by clients.
- Review and audit session management logic to ensure no other endpoints or mechanisms allow manipulation of critical session attributes.
- Enforce strong authentication and monitor session creation logs for anomalous patterns such as unusually long expiration times or repeated use of predictable session tokens.
- Educate developers and administrators about the importance of server-side control over session attributes and the risks of improper attribute modification.
- Conduct penetration testing focused on session management to verify that session tokens and expiration cannot be manipulated by authenticated users.
- Apply strict input validation and sanitization on all client-supplied data related to session objects. 8.
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session object via `POST /classes/_Session`. This allows bypassing the server's session expiration policy by setting an arbitrary far-future expiration date. It also allows setting a predictable session token value. Starting in version 9.6.0-alpha.17 and 8.6.42, the session creation endpoint filters out server-generated fields from user-supplied data, preventing them from being overwritten. As a workaround, add a `beforeSave` trigger on the `_Session` class to validate and reject or strip any user-supplied values for `sessionToken`, `expiresAt`, and `createdWith`.