Cyber Resilience

CVE-2026-32269

Parseplatform Parse-Server 8.0.2 – 8.6.39

Published
12 March 2026
Modified
13 March 2026
Patch / advisory
View advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0028 20th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-32269 is a medium-severity Function Call With Incorrect Order of Arguments (CWE-683) vulnerability in Parseplatform Parse-Server. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During…

more

app ID validation, a malformed value is sent to the token introspection endpoint instead of the user's actual access token. Depending on the introspection endpoint's behavior, this could either cause all OAuth2 logins to fail, or allow authentication from disallowed app contexts if the endpoint returns valid-looking data for the malformed request. Deployments using the OAuth2 adapter with appidField and appIds configured are affected. This vulnerability is fixed in 9.6.0-alpha.13 and 8.6.39.

CWE(s)
CWE-683

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

OAuth2 auth validation bypass in public-facing Parse Server backend enables exploitation of internet-facing application for unauthorized access.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-30938Same product: Parseplatform Parse-Server
CVE-2026-35200Same product: Parseplatform Parse-Server
CVE-2026-32098Same product: Parseplatform Parse-Server
CVE-2026-32234Same product: Parseplatform Parse-Server
CVE-2026-34784Same product: Parseplatform Parse-Server
CVE-2026-30854Same product: Parseplatform Parse-Server
CVE-2026-43930Same product: Parseplatform Parse-Server
CVE-2026-30947Same product: Parseplatform Parse-Server
CVE-2026-31800Same product: Parseplatform Parse-Server
CVE-2026-32878Same product: Parseplatform Parse-Server

Affected Assets

parseplatform
parse-server
9.6.0 · 8.0.2 — 8.6.39 · 9.0.0 — 9.6.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SI-10 Information Input Validation
  • IA-2 Identification and Authentication (Organizational Users)
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces the app-ID allow-list check during OAuth2 token validation that the vulnerable adapter bypasses.

SI-10 Information Input Validation good match
prevent

Requires validation of the supplied app-ID and token values before they are forwarded to the introspection endpoint.

IA-2 Identification and Authentication (Organizational Users) partial match
prevent

Mandates reliable identification and authentication of users via the OAuth2 adapter, which the flaw undermines.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (code review, static analysis, compiler checks) directly catch argument-order errors during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect argument-order defects, yet testing coverage is rarely exhaustive.

A.8.25 Secure development life cycle partial match
prevents

A secure SDLC process encourages practices that reduce such weaknesses but does not directly address argument ordering.

A.8.28 Secure coding partial match
prevents

Secure coding standards can mandate argument-order checks and static analysis, but do not guarantee elimination of all ordering mistakes.

References