CVE-2026-34532

When a Cloud Function handler is declared with the 'function' keyword and its validator is a plain object or arrow function, the handler lookup mechanism searches the JavaScript prototype chain. However, the validator is stored in a separate location that does not reflect the same prototype chain search. As a result, when an attacker adds 'prototype.constructor' to the function name in an HTTP request, the server finds the handler through the prototype chain but does not find the corresponding validator — resulting in complete bypass of access control enforcement. An attacker can thus invoke functions protected by validators such as requireUser, requireMaster, or custom validation logic.

An unauthenticated attacker can invoke any protected Cloud Functions, including those requiring user permissions or master key, which may lead to unauthorized reading and modification of application data.

Parse Server should be updated to version 8.6.67 or newer (v8 branch) or to version 9.7.0-alpha.11 or newer (v9 branch). Patches are available in vendor references under commits 4fc48cf and dc59e27.

Parse Server (parseplatform parse-server) in versions earlier than 8.6.67 (v8 branch) and earlier than 9.7.0-alpha.11 (v9 branch)