9.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34532

CVE-2026-34532: Parse Server: Cloud function validator bypass via prototype chain traversal

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped. This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic. This issue has been patched in versions 8.6.67 and 9.7.0-alpha.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34532

CVE-2026-34532:

9.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.7.0-alpha.11	9.7.0-alpha.11
parse-server	npm	< 8.6.67	8.6.67

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the getStore function within src/triggers.js of the parse-server package. This function is used to look up and retrieve Cloud Functions. The vulnerability allows an attacker to bypass Cloud Function validators by crafting a special path in the URL that includes .prototype.constructor. The getStore function would then traverse the prototype chain of the Cloud Function object, leading to the validator being ignored.

The patch addresses this by adding a check within the getStore function. The line if (!store || Object.getPrototypeOf(store) !== null) ensures that during the lookup process, the code does not traverse into the prototype of an object. If it detects that it's about to access a property from the prototype chain, it stops and returns an empty result, effectively preventing the validator bypass. The provided commit patches clearly show this change being applied to the getStore function, confirming it as the location of the vulnerability and the fix.

Vulnerable functions

getStore

src/triggers.js

The `getStore` function is responsible for retrieving cloud functions and their validators. Before the patch, it was possible to traverse the prototype chain of a function object by providing a crafted function name in the request URL (e.g., `functionName.prototype.constructor`). This allowed an attacker to bypass the function's validator. The patch introduces a check to ensure that the traversal does not go up the prototype chain, thus preventing the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.