GHSA-hpm8-9qx6-jvwv
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hpm8-9qx6-jvwv
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hpm8-9qx6-jvwv/GHSA-hpm8-9qx6-jvwv.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hpm8-9qx6-jvwv
- Aliases
- Published
- 2026-04-01T23:09:14Z
- Modified
- 2026-04-06T15:27:18.137809623Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Parser Server's streaming file download bypasses afterFind file trigger authorization
- Details
-
Impact
File downloads via HTTP Range requests bypass the
afterFind(Parse.File)trigger and its validators on storage adapters that support streaming (e.g. the default GridFS adapter). This allows access to files that should be protected byafterFindtrigger authorization logic or built-in validators such asrequireUser.Patches
The streaming file download path now executes the
afterFind(Parse.File)trigger before sending any data. Authentication is resolved from the session token header so that trigger validators can distinguish authenticated from unauthenticated requests.Workarounds
Use
beforeFind(Parse.File)instead ofafterFind(Parse.File)for file access authorization. ThebeforeFindtrigger runs on all download paths including streaming. - Database specific
{ "github_reviewed_at": "2026-04-01T23:09:14Z", "nvd_published_at": "2026-03-31T20:16:29Z", "cwe_ids": [ "CWE-285" ], "severity": "HIGH", "github_reviewed": true }- References
-
- https://github.com/parse-community/parse-server/security/advisories/GHSA-hpm8-9qx6-jvwv
- https://nvd.nist.gov/vuln/detail/CVE-2026-34784
- https://github.com/parse-community/parse-server/pull/10361
- https://github.com/parse-community/parse-server/pull/10362
- https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337
- https://github.com/parse-community/parse-server/commit/a0b0c69fc44f87f80d793d257344e7dcbf676e22
- https://github.com/parse-community/parse-server
Affected packages
npm / parse-server
Package
- Name
- parse-server
- View open source insights on deps.dev
- Purl
- pkg:npm/parse-server
npm / parse-server
Package
- Name
- parse-server
- View open source insights on deps.dev
- Purl
- pkg:npm/parse-server