5.3

CVE-2026-33323

Parse Server: Email verification resend page leaks user existence

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whether the provided username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing different redirect targets. The existing emailVerifySuccessOnInvalidEmail configuration option, which is enabled by default and protects the API route against this, did not apply to these routes. This issue has been patched in versions 8.6.51 and 9.6.0-alpha.40.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Parseplatform ≫ Parse-server SwPlatform node.js Version < 8.6.51
Parseplatform ≫ Parse-server SwPlatform node.js Version >= 9.0.0 < 9.6.0
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha1 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha10 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha11 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha12 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha13 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha14 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha15 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha16 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha17 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha18 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha19 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha2 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha20 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha21 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha22 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha23 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha24 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha25 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha26 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha27 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha28 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha29 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha3 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha30 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha31 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha32 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha33 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha34 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha35 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha36 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha37 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha38 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha39 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha4 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha5 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha6 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha7 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha8 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.6.0 Update alpha9 SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.246
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
security-advisories@github.com 6.3 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-204 Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f
Vendor Advisory
https://github.com/parse-community/parse-server/pull/10238
Issue Tracking
https://github.com/parse-community/parse-server/pull/10243
Issue Tracking
https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5
Patch
https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3
Patch