Improper Neutralization of Special Elements in Data Query Logic in Parse Server - CVE-2026-32248
Published: April 6, 2026
Vulnerability identifier: #VU125002
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-32248
CWE-ID: CWE-943
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to take over user accounts.
The vulnerability exists due to improper neutralization of special elements in data query logic in the authentication data identifier handling when processing crafted login requests. A remote attacker can send a specially crafted login request to take over user accounts.
Any deployment that allows anonymous authentication is vulnerable, and both MongoDB and PostgreSQL database backends are affected.
Affected software
Parse Server
How to mitigate CVE-2026-32248
Install security update from vendor's website.
Parse Server - addressed in versions 8.6.38, 9.6.0 alpha.12