CVE-2026-34784: Parse Server: Streaming file download bypasses afterFind file trigger authorization
Impact
File downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators on storage adapters that support streaming (e.g. the default GridFS adapter). This allows access to files that should be protected by afterFind trigger authorization logic or built-in validators such as requireUser.
Patches
The streaming file download path now executes the afterFind(Parse.File) trigger before sending any data. Authentication is resolved from the session token header so that trigger validators can distinguish authenticated from unauthenticated requests.
Workarounds
Use beforeFind(Parse.File) instead of afterFind(Parse.File) for file access authorization. The beforeFind trigger runs on all download paths including streaming.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators on storage adapters that support streaming (e.g. the default GridFS adapter). This allows access to files that should be protected by afterFind trigger authorization logic or built-in validators such as requireUser. This issue has been patched in versions 8.6.71 and 9.7.1-alpha.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 8.6.71 - Upgrade
Upgrade
npm/parse-serverto a version that resolves this vulnerability.Fixed in 9.7.1-alpha.1 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.71 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.7.1-alpha.1 - Configuration
For file access authorization, use `beforeFind(Parse.File)` instead of `afterFind(Parse.File)`, since HTTP Range streaming file downloads could bypass `afterFind(Parse.File)` trigger validators in affected versions.
Parse Server triggers for file access authorization Use of afterFind(Parse.File) vs beforeFind(Parse.File) = beforeFind(Parse.File)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34784?
CVE-2026-34784 has a moderate severity level due to its potential for unauthorized file access.
How do I fix CVE-2026-34784?
To fix CVE-2026-34784, upgrade to Parse Server versions 8.6.71 or 9.7.1-alpha.1 or later.
What does CVE-2026-34784 affect?
CVE-2026-34784 affects the file download functionality in Parse Server versions prior to 8.6.71 and 9.7.1-alpha.1.
What type of vulnerability is CVE-2026-34784?
CVE-2026-34784 is a vulnerability that allows unauthorized access to files through HTTP Range requests.
Who is responsible for addressing CVE-2026-34784?
Developers using affected versions of Parse Server are responsible for applying updates to mitigate CVE-2026-34784.