CVE-2026-31828 - Vulnerability Analysis

Overview

Parse Server < 9.5.2-alpha.13 and < 8.6.26 contains an LDAP injection caused by unescaped user input in LDAP DN and group search filters, letting authenticated LDAP users escalate privileges by bypassing group checks.

Severity & Score

Impact

Authenticated LDAP users can escalate privileges to any restricted group, potentially gaining unauthorized access.

Mitigation

Update to versions 9.5.2-alpha.13 or 8.6.26 or later.

References

• https://github.com/parse-community/parse-server/releases/tag/8.6.26
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.13
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner