Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-33429

19
FAUCET Score

CVE-2026-33429 affects Parse Server versions prior to 8.6.54 and 9.6.0-alpha.43, allowing an attacker to infer the state of protected fields via LiveQuery subscriptions. By observing the presence or absence of update events, an attacker can determine if a protected field has changed, creating a binary oracle for information disclosure, particularly for boolean fields. This vulnerability carries a CVSS score of 5.3 (Medium) due to its network attack vector and low complexity, resulting in a low confidentiality impact. There is currently no evidence of active exploitation, nor is public exploit code or significant community discussion available for this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 8.6.54CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
>= 9.0.0, < 9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*
9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*
9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 4.0

6.3MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
LOW
VS Integrity
NONE
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.32%
Probability of exploitation in next 30 days
EPSS Percentile
24.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0032 is in the 14th percentile among its peer group of 23,725 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: parse-serverFixed in: 9.6.0-alpha.43
npmpatch availablevia ghsa
Product: parse-serverFixed in: 8.6.54

Vendor Advisories (1)

npmGHSA-qpc3-fg4j-8hgmmedium

Parse Server has a protected field change detection oracle via LiveQuery watch parameter

Mar 20, 2026

References

github.com / parse-community/parse-server/commit/0c0a0a5a37ca821d2553119f2cb3be35322eda4b
Patch
github.com / parse-community/parse-server/commit/c62eacaf38de86913f09240583448360b1cc8e67
Patch
github.com / parse-community/parse-server/pull/10253
Issue Tracking
github.com / parse-community/parse-server/pull/10254
Issue Tracking
github.com / parse-community/parse-server/security/advisories/GHSA-qpc3-fg4j-8hgm
Vendor Advisory