CVE-2026-32248

creationtimestamp| type| source ---|---|--- 2026-03-12 22:17:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgvgiq367b2x 2026-03-13 07:32:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116220700178176253 2026-03-13 08:10:06+00:00| seen|...

CVE-2026-32248 Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user...

@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), @kontaa/subgraph (>=1.0.1, <=1.2.3) +27 more potentially affected by CVE-2026-32248 via parse-server (>=2.0.8, <=7.5.4)

parse-server NPM version =2.0.8, =1.0.5, =1.0.1, =1.2.1, =2.4.46, =2.4.8, =1.0.0, =1.0.0, =1.0.1, =0.1.1, =0.0.2, =1.0.0, =0.1.0, =0.1.7, =0.0.1, =0.0.29 - parse-cli-server2 0.0.30 and more Source cves: CVE-2026-32248 Source advisory: MEND:CVE-2026-32248...