CVE-2026-33163

🗓️ 18 Mar 2026 21:58:04Reported by GitHub_MType

Parse Server leaks protected fields and authData to subscribers via afterLiveQueryEvent; remove triggers.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-33163	18 Mar 202621:58	–	attackerkb
CNNVD	Parse Server 信息泄露漏洞	18 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33163 Parse Server leaks protected fields via LiveQuery afterEvent trigger	18 Mar 202621:58	–	cvelist
EUVD	EUVD-2026-12994	18 Mar 202619:49	–	euvd
Github Security Blog	Parse Server leaks protected fields via LiveQuery afterEvent trigger	18 Mar 202619:49	–	github
NVD	CVE-2026-33163	18 Mar 202622:16	–	nvd
OSV	BIT-PARSE-2026-33163 Parse Server leaks protected fields via LiveQuery afterEvent trigger	20 Mar 202611:37	–	osv
OSV	CVE-2026-33163 Parse Server leaks protected fields via LiveQuery afterEvent trigger	18 Mar 202621:58	–	osv
OSV	GHSA-5HMJ-JCGP-6HFF Parse Server leaks protected fields via LiveQuery afterEvent trigger	18 Mar 202619:49	–	osv
Positive Technologies	PT-2026-26166	18 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

parseplatform parse-serverRange<8.6.50node.js

parseplatform parse-serverRange9.0.0–9.6.0node.js

parseplatform parse-serverMatch9.6.0alpha1node.js

parseplatform parse-serverMatch9.6.0alpha10node.js

parseplatform parse-serverMatch9.6.0alpha11node.js

parseplatform parse-serverMatch9.6.0alpha12node.js

parseplatform parse-serverMatch9.6.0alpha13node.js

parseplatform parse-serverMatch9.6.0alpha14node.js

parseplatform parse-serverMatch9.6.0alpha15node.js

parseplatform parse-serverMatch9.6.0alpha16node.js

parseplatform parse-serverMatch9.6.0alpha17node.js

parseplatform parse-serverMatch9.6.0alpha18node.js

parseplatform parse-serverMatch9.6.0alpha19node.js

parseplatform parse-serverMatch9.6.0alpha2node.js

parseplatform parse-serverMatch9.6.0alpha20node.js

parseplatform parse-serverMatch9.6.0alpha21node.js

parseplatform parse-serverMatch9.6.0alpha22node.js

parseplatform parse-serverMatch9.6.0alpha23node.js

parseplatform parse-serverMatch9.6.0alpha24node.js

parseplatform parse-serverMatch9.6.0alpha25node.js

parseplatform parse-serverMatch9.6.0alpha26node.js

parseplatform parse-serverMatch9.6.0alpha27node.js

parseplatform parse-serverMatch9.6.0alpha28node.js

parseplatform parse-serverMatch9.6.0alpha29node.js

parseplatform parse-serverMatch9.6.0alpha3node.js

parseplatform parse-serverMatch9.6.0alpha30node.js

parseplatform parse-serverMatch9.6.0alpha31node.js

parseplatform parse-serverMatch9.6.0alpha32node.js

parseplatform parse-serverMatch9.6.0alpha33node.js

parseplatform parse-serverMatch9.6.0alpha34node.js

parseplatform parse-serverMatch9.6.0alpha4node.js

parseplatform parse-serverMatch9.6.0alpha5node.js

parseplatform parse-serverMatch9.6.0alpha6node.js

parseplatform parse-serverMatch9.6.0alpha7node.js

parseplatform parse-serverMatch9.6.0alpha8node.js

parseplatform parse-serverMatch9.6.0alpha9node.js

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": ">= 9.0.0, < 9.6.0-alpha.35",
        "status": "affected"
      },
      {
        "version": "< 8.6.50",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-5hmj-jcgp-6hff
github	www.github.com/parse-community/parse-server/pull/10232
github	www.github.com/parse-community/parse-server/pull/10233

19 Mar 2026 16:35Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

CVSS 48.2

EPSS0.00038

SSVC

CWE-200