BIT-PARSE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1 protectedFields Bypass via Relation Count Query

Parse Server before 8.6.93 and 9.0.0 before 9.10.1 does not enforce identity-scoped protectedFields authenticated, role, or per-user groups on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can...