CVE-2026-33527

Description

### Impact An authenticated user can overwrite server-generated session fields such as `expiresAt` and `createdWith` when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. ### Patches The fix blocks authenticated users from setting `expiresAt` and `createdWith` fields when updating a session. Master key and maintenance key operations are not affected. ### Workarounds There is no known workaround other than upgrading. ### Resources - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q - Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10263 - Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10264

How to fix CVE-2026-33527

To remediate CVE-2026-33527, upgrade the affected package to a fixed version below.

• —upgrade to 8.6.57 or later
• —upgrade to 9.6.0-alpha.48 or later

Is CVE-2026-33527 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 8.6.57, >= 9.0.0, < 9.6.0
• >= 9.0.0, < 9.6.0-alpha.48

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-33527
• PATCHgithub.com/parse-community/parse-server
• WEBgithub.com/parse-community/parse-server/commit/26b628c8fb3cc79ea955374769eebcff6f8a8a73
• WEBgithub.com/parse-community/parse-server/commit/ea68fc0b22a6056c9675149469ff57817f7cf984