CVE-2026-33323
MEDIUM EPSS 24.0%
Published Mar 24, 20263mo ago · Modified Jun 17, 20262w ago
6.3 CVSS 4.0
Published Mar 24, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whether the provided username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing different redirect targets. The existing emailVerifySuccessOnInvalidEmail configuration option, which is enabled by default and protects the API route against this, did not apply to these routes. This issue has been patched in versions 8.6.51 and 9.6.0-alpha.40.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
24.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-204
Affected Products 41
| Vendor | Product | Version | Range |
|---|---|---|---|
| parseplatform | parse-server | * | <8.6.51 |
| parseplatform | parse-server | * | ≥9.0.0 – <9.6.0 |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
| parseplatform | parse-server | 9.6.0 | any |
References 5
- github.com https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5
- github.com https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3
- github.com https://github.com/parse-community/parse-server/pull/10238
- github.com https://github.com/parse-community/parse-server/pull/10243
- github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f
Remediation
- github.com https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5
- github.com https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3