CVE-2026-33421 Parseplatform — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.1 (HIGH)
Affected Versions	9.0.0 — 9.6.0
Fixed In	8.6.53
Type	CWE-863 (Incorrect Authorization)
Vendor	Parseplatform
Public PoC	No

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and pointerFields). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user.

This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is correctly restricted via the REST API. This issue has been patched in versions 8.6.53 and 9.6.0-alpha.42.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Attack Requirements

None

No additional conditions

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

None

No data modification

Availability

None

No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-863 Incorrect Authorization

Vulnerable Products 43

Configuration	From (including)	Up to (excluding)
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server::::::node.js::*	—	`8.6.53`
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server::::::node.js::*	`9.0.0`	`9.6.0`
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9::::node.js::*	—	—