CVE-2026-32248

An attacker sends a crafted login request that causes the server to execute a pattern-matching query instead of an exact-match lookup. This results from improper input handling in the database query layer (CWE-943 — improper neutralization of special elements in data query). This allows the attacker to match an existing user account and obtain a valid session token without knowing the password. The issue affects both MongoDB and PostgreSQL backends.

An attacker obtains a valid session token for a selected user account, enabling complete account takeover and impersonation. This can lead to unauthorized data access and privilege escalation in applications using Parse Server.

Parse Server must be updated to version 8.6.38 or 9.6.0-alpha.12 (or newer). Details available in vendor references: https://github.com/parse-community/parse-server/releases/tag/8.6.38 and https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.12. Until the patch is implemented, consider disabling anonymous authentication if not required by the application.

Parse Server (parseplatform/parse-server) in versions prior to 8.6.38 and prior to 9.6.0-alpha.12, with anonymous authentication enabled (active by default). Affects deployments using MongoDB or PostgreSQL databases.