{"id":"CVE-2026-33539","aliases":["BIT-parse-2026-33539","EUVD-2026-14976","GHSA-p2w6-rmh7-w8q3"],"status":"published","title":"Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0047,"percentile":0.40888,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-03-24T18:26:56Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"npm","package":"parse-server","fixed_in":["9.6.0-alpha.53","8.6.59"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"parse","fixed_in":["8.6.59","9.6.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.6.0-alpha.53"}]}]},{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.59"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"parse","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.6.59"},{"introduced":"9.0.0"},{"fixed":"9.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.6.0-alpha.53"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.6.59"}]}]}],"products":[{"vendor":"parse-community","product":"parse-server"},{"vendor":"parseplatform","product":"parse-server"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-p2w6-rmh7-w8q3","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/parse-community/parse-server/pull/10272","tags":["x_refsource_MISC","Issue Tracking","report","fix","web"]},{"url":"https://github.com/parse-community/parse-server/pull/10273","tags":["x_refsource_MISC","Issue Tracking","report","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/03249f9bf5b8783c8b848f84dab791ff0b761b8c","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/bdddab5f8b61a40cb8fc62dd895887bdd2f3838e","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33539","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p2w6-rmh7-w8q3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33539.json","tags":["advisory"]},{"url":"https://github.com/parse-community/parse-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33539","title":"Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.","status":"published","published":"2026-03-24T18:26:56.046Z","modified":"2026-03-26T19:52:13.216Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-14976","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.","status":"published","published":"2026-03-24T18:26:56Z","modified":"2026-03-26T19:52:13Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"ghsa":[{"id":"GHSA-p2w6-rmh7-w8q3","title":"Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter","description":"### Impact\n\nAn attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate `$group` pipeline stage or the `distinct` operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.\n\nOnly Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected.\n\n### Patches\n\nField names in the aggregate `$group._id` object values and `distinct` dot-notation parameters are now validated to only contain alphanumeric characters and underscores, preventing SQL injection via the `:raw` interpolation used in the PostgreSQL storage adapter.\n\n### Workarounds\n\nNo workaround. Upgrade to a patched version.","status":"published","published":"2026-03-24T19:12:06Z","modified":"2026-03-27T21:54:07Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:39:44.97342Z"}],"nvd":[{"id":"CVE-2026-33539","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.","status":"published","published":"2026-03-24T19:16:54.853Z","modified":"2026-06-17T10:37:40.66Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:10.568062Z"}],"osv":[{"id":"CVE-2026-33539","title":"Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-alpha.53.","status":"published","published":"2026-03-24T18:26:56.046Z","modified":"2026-10-28T02:30:23.579032504Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"GHSA-p2w6-rmh7-w8q3","title":"Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter","description":"### Impact\n\nAn attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate `$group` pipeline stage or the `distinct` operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access.\n\nOnly Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected.\n\n### Patches\n\nField names in the aggregate `$group._id` object values and `distinct` dot-notation parameters are now validated to only contain alphanumeric characters and underscores, preventing SQL injection via the `:raw` interpolation used in the PostgreSQL storage adapter.\n\n### Workarounds\n\nNo workaround. Upgrade to a patched version.","status":"published","published":"2026-03-24T19:12:06Z","modified":"2026-03-27T22:03:50.528822Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"BIT-parse-2026-33539","title":"Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0","status":"published","published":"2026-03-27T07:14:42.086Z","modified":"2026-09-08T08:48:17.670524017Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}