CVE-2026-31901

MEDIUM EPSS 15.1%
Published Mar 11, 20263mo ago · Modified Jun 17, 20262w ago
6.3 CVSS 4.0
Medium
Find Similar
Published Mar 11, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to an existing user, is already verified, or does not exist. An attacker can send requests with different email addresses and observe the error codes to determine which email addresses are registered in the application. This is a user enumeration vulnerability that affects any Parse Server deployment with email verification enabled (verifyUserEmails: true). This vulnerability is fixed in 8.6.34 and 9.6.0-alpha.8.

CVSS Details

Base Score
6.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
15.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-204

Affected Products 9

VendorProductVersionRange
parseplatformparse-server* <8.6.34
parseplatformparse-server*≥9.0.0  –  <9.6.0
parseplatformparse-server9.6.0any
parseplatformparse-server9.6.0any
parseplatformparse-server9.6.0any
parseplatformparse-server9.6.0any
parseplatformparse-server9.6.0any
parseplatformparse-server9.6.0any
parseplatformparse-server9.6.0any

References 3

  • github.com https://github.com/parse-community/parse-server/releases/tag/8.6.34
    ProductRelease Notes
  • github.com https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.8
    ProductRelease Notes
  • github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856
    PatchVendor Advisory

Remediation

  • github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856
    PatchVendor Advisory