All vulnerabilities
CVE-2026-116801GHSA-58m4-cqvw-4vgh

parse-server: Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

parse-community parse-server
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9.10.5-alpha.6Also 8.6.105CVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.

Text from CVE List

Affected versions 4

  • parse-serveraffected: 9.0.0 before 9.10.5-alpha.6CVE List
  • parse-serverunaffected: 9.10.5-alpha.6CVE List
  • parse-serveraffected: all versions before 8.6.105CVE List
  • parse-serverunaffected: 8.6.105CVE List

References 2