CVE-2026-33527 Parseplatform — Exploit & Vulnerability Details MEDIUM

Parameter	Value
CVSS	5.3 (MEDIUM)
Affected Versions	9.0.0 — 9.6.0
Fixed In	8.6.57
Type	CWE-863 (Incorrect Authorization)
Vendor	Parseplatform
Public PoC	No

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent.

This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Attack Requirements

None

No additional conditions

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

None

No data leak

Integrity

Low

Partial data modification

Availability

None

No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-863 Incorrect Authorization

Vulnerable Products 49

Configuration	From (including)	Up to (excluding)
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server::::::node.js::*	—	`8.6.57`
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server::::::node.js::*	`9.0.0`	`9.6.0`
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha42::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha43::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha44::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha45::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha46::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha47::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8::::node.js::*	—	—
Parseplatform Parse-Server cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9::::node.js::*	—	—