CVE-2026-34784

🗓️ 31 Mar 2026 19:39:54Reported by GitHub_MType

CVE-2026-34784: Parse Server streaming file downloads bypass afterFind(Parse.File) authorization.

Reporter	Title	Published	Views	Family All 21
attackerkb	CVE-2026-34784	31 Mar 202619:39	–	attackerkb
Circl	CVE-2026-34784	31 Mar 202621:19	–	circl
CNNVD	Parse Server authorization issue vulnerability	31 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-34784 Parse Server: Streaming file download bypasses afterFind file trigger authorization	31 Mar 202619:39	–	cvelist
EUVD	EUVD-2026-17608	1 Apr 202623:09	–	euvd
Github Security Blog	Parser Server's streaming file download bypasses afterFind file trigger authorization	1 Apr 202623:09	–	github
Mend	CVE-2026-34784	31 Mar 202619:39	–	mend
NVD	CVE-2026-34784	31 Mar 202620:16	–	nvd
osv_bit	BIT-PARSE-2026-34784 Parse Server: Streaming file download bypasses afterFind file trigger authorization	6 Apr 202614:49	–	osv_bit
osv_cve	CVE-2026-34784 Parse Server: Streaming file download bypasses afterFind file trigger authorization	31 Mar 202619:39	–	osv_cve

NVD

Vulners

Node

parseplatform parse-serverRange<8.6.71node.js

parseplatform parse-serverRange9.0.0–9.7.1node.js

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": "< 8.6.71",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.7.1-alpha.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/commit/a0b0c69fc44f87f80d793d257344e7dcbf676e22
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-hpm8-9qx6-jvwv
github	www.github.com/parse-community/parse-server/pull/10361
github	www.github.com/parse-community/parse-server/pull/10362
github	www.github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337

24 Jul 2026 20:10Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.17.5

CVSS 48.2

EPSS0.00378

SSVC

CWE-285