CVE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields authenticated, role, or per-user groups on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object...

PT-2026-110720

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.93 Parse Server versions 9.0.0 through 9.10.1-alpha.12 Description Identity-scoped protectedFields including authenticated, role, or per-user groups are not enforced on count queries that utilize the $related...

CVE-2026-53726

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting clie...

CVE-2026-53726: Authorization Bypass Through User-Controlled Key

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting clie...