CVE-2026-109303

Parse Server versions before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 contain a vulnerability where the system fails to enforce identity-scoped protectedFields (such as authenticated, role, or per-user groups) during count queries using the $relatedTo operator. This flaw allows an authenticated us...