CVE-2026-34532: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34532 is a Cloud Function validator bypass vulnerability in Parse Server (open source Node.js backend) caused by prototype chain traversal. An unauthenticated attacker can bypass access control validators — including requireUser, requireMaster, and custom validation logic — by appending .prototype.constructor to a Cloud Function name in the URL. Affected versions are all Parse Server releases prior to 8.6.67 (8.x branch) and 9.0.0 through 9.7.0-alpha.10 (9.x branch). The vulnerability was disclosed on March 31, 2026, with patches released on March 28, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization), stemming from an asymmetry in how the trigger store and validator store traverse the function registry. When a Cloud Function handler is declared using the function keyword, the trigger store's getStore() function in src/triggers.js resolves the handler by traversing the store object's prototype chain. However, the validator store does not mirror this traversal, so when an attacker appends .prototype.constructor to the function name in the URL (e.g., POST /1/functions/protectedFn.prototype.constructor), the handler is resolved via the prototype chain while the validator lookup returns nothing — causing all access control enforcement to be silently skipped. The fix adds a single check in getStore(): if (!store || Object.getPrototypeOf(store) !== null), which rejects any resolved store node that is not a null-prototype object, preventing prototype chain escape (GitHub Advisory, Fix Commit v8, Fix Commit v9).

Successful exploitation allows unauthenticated remote attackers to invoke any Cloud Function that is protected by validators such as requireUser, requireMaster, or custom authorization logic, effectively bypassing all authentication and authorization controls on those endpoints. This can expose sensitive backend operations and data to unauthorized callers, with high impact to both confidentiality and integrity of the vulnerable system. Availability is not directly impacted, but the ability to invoke privileged backend functions without credentials could enable data exfiltration, unauthorized data modification, or further lateral movement within the application's backend (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it highly automatable once the technique is known. The EPSS score is approximately 0.044% (0.000440), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Parse Server instances (versions < 8.6.67 or 9.0.0–9.7.0-alpha.10) using tools like Shodan or Censys, searching for the Parse Server API endpoint (typically /1/functions/).
2. Enumerate Cloud Functions: Probe the target for known or guessable Cloud Function names by sending standard POST requests to /1/functions/<name> and observing error responses (e.g., VALIDATION_ERROR indicates a protected function exists).
3. Craft bypass request: Append .prototype.constructor to the discovered function name in the URL, e.g., POST /1/functions/protectedFn.prototype.constructor, with standard Parse headers (X-Parse-Application-Id, X-Parse-REST-API-Key) and an empty JSON body.
4. Bypass validator: The server's getStore() traversal resolves the handler via the prototype chain while the validator store returns nothing, causing all access control checks to be skipped — the function executes without authentication.
5. Achieve objective: The protected Cloud Function executes in the context of an unauthenticated caller, potentially returning sensitive data, performing privileged operations, or enabling further exploitation of the backend (GitHub Advisory, Fix PR v9).

• Network: HTTP POST requests to Parse Server endpoints matching the pattern /1/functions/<functionName>.prototype.constructor or /1/functions/<functionName>.prototype from unauthenticated clients (no valid session token or master key).
• Logs: Parse Server access logs showing requests to Cloud Function endpoints with .prototype or .prototype.constructor in the function name path segment; successful HTTP 200 responses to such requests on unpatched servers.
• Application Behavior: Cloud Functions returning results to callers that lack the required session token, master key, or other credentials normally enforced by validators such as requireUser or requireMaster.

Upgrade Parse Server to version 8.6.67 (8.x LTS branch) or 9.7.0-alpha.11 (or the stable 9.7.0 release) to apply the patch (GitHub Advisory, Fix PR v8, Fix PR v9). As an immediate workaround for those unable to upgrade, rewrite all Cloud Function handlers using arrow functions instead of the function keyword — arrow functions do not have a prototype property and are not susceptible to this traversal. Organizations running any 8.x version below 8.6.67 or any 9.x version below 9.7.0 should treat this as a high-priority patch given the unauthenticated, network-exploitable nature of the vulnerability.

The advisory was published by Parse Server maintainer mtrezza and credited bugbunny-research as the reporter (GitHub Advisory). The vulnerability was noted in automated vulnerability tracking feeds and aggregators shortly after disclosure, with no significant public researcher commentary or media coverage identified beyond standard CVE distribution channels.