CVE-2026-34784: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34784 is an improper authorization vulnerability in Parse Server, an open-source Node.js backend, where file downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators on storage adapters that support streaming (e.g., the default GridFS adapter). This allows unauthenticated or unauthorized access to files that should be protected by afterFind trigger authorization logic or built-in validators such as requireUser. Affected versions include all Parse Server releases prior to 8.6.71 and versions 9.0.0 through 9.7.0. The vulnerability was published on March 31, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is CWE-285 (Improper Authorization): the streaming file download code path in src/Routers/FilesRouter.js did not invoke the afterFind(Parse.File) trigger before initiating a ranged (HTTP Range header) response via filesController.handleFileStream(). As a result, any authorization logic or validators (e.g., requireUser) registered in the afterFind trigger were silently skipped for partial content requests. Additionally, the pre-fix code passed req.auth (which could be null or unauthenticated) to trigger invocations rather than resolving authentication from the X-Parse-Session-Token header via a dedicated _resolveAuth() helper. The fix ensures the afterFind trigger is awaited and its result applied before any streaming response is sent, and introduces per-request auth resolution from session token headers (GitHub Advisory, Fix PR #10361, Fix PR #10362).

Successful exploitation allows unauthenticated or unauthorized network attackers to download files that are intended to be access-controlled via Parse Server's afterFind(Parse.File) trigger, including files protected by the requireUser validator. The impact is limited to confidentiality — there is no integrity or availability impact — but sensitive files stored in streaming-capable adapters (such as the default GridFS/MongoDB adapter) are fully exposed to unauthorized access. Depending on the application, this could include user-uploaded documents, private media, or other sensitive data (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is exploitable without authentication or privileges, requiring only network access and knowledge of a file URL. The EPSS score is approximately 0.044% (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a Parse Server instance (version < 8.6.71 or 9.0.0–9.7.0) that uses a streaming-capable storage adapter (e.g., GridFS/MongoDB) and has afterFind(Parse.File) authorization triggers configured.
2. Obtain a file URL: Identify or enumerate a file URL hosted on the Parse Server (e.g., via application functionality, public endpoints, or prior knowledge). File URLs typically follow the pattern https://<host>/parse/files/<appId>/<filename>.
3. Craft a Range request: Send an HTTP GET request to the file URL with a Range header (e.g., Range: bytes=0-1023) and without a valid session token or authentication credentials:

   GET /parse/files/<appId>/secret.txt HTTP/1.1
   Host: <target>
   X-Parse-Application-Id: <appId>
   X-Parse-REST-API-Key: <restKey>
   Range: bytes=0-2

4. Receive unauthorized file content: The server responds with HTTP 206 Partial Content and streams the file data, bypassing the afterFind trigger and any requireUser or custom authorization validators.
5. Repeat for full file: Iterate Range requests to download the complete file content in chunks (GitHub Advisory, Fix Commit).

• Network: Unusual HTTP GET requests to Parse Server file endpoints (/parse/files/<appId>/) containing a Range header (e.g., Range: bytes=0-N) without an X-Parse-Session-Token header, especially for files that should require authentication.
• Logs: Parse Server access logs showing HTTP 206 responses to file download requests lacking session tokens; repeated ranged requests to the same file URL from the same IP address.
• Behavioral: Systematic enumeration of file URLs followed by ranged download requests, potentially indicating automated scraping of protected file content.

Upgrade Parse Server to version 8.6.71 (for the 8.x LTS branch) or 9.7.1-alpha.1 or later (for the 9.x branch); the fix is also included in the stable 9.8.0 release (Fix PR #10362, Fix PR #10361). As a workaround for environments that cannot immediately upgrade, replace afterFind(Parse.File) authorization logic with beforeFind(Parse.File) triggers, which run on all download paths including streaming and are not affected by this bypass (GitHub Advisory). After patching, verify that file download endpoints correctly return HTTP 403 for unauthenticated requests to protected files.

The vulnerability was reported and patched by Parse Server maintainer mtrezza, who published the GitHub Security Advisory (GHSA-hpm8-9qx6-jvwv) on March 30, 2026. The fix was released simultaneously for both the 8.x LTS and 9.x alpha branches on the same day. A Mastodon post from @thehackerwire noted the disclosure shortly after publication. No significant broader media coverage or notable community controversy has been observed (GitHub Advisory).