CVE-2026-53726 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting client by protectedFields, and even when the object owning the relation was not readable by the client under its ACL or class-level permissions. The request requires only the public API credentials that Parse clients normally carry — no user session, master key, or Cloud Code is needed. As a result, an unauthenticated client who knows or obtains the owning object's objectId could enumerate the objects linked through a protected relation, or combine the operator with an objectId constraint to use it as a membership oracle — confirming whether a specific object is linked to a private parent. This affects applications that rely on protectedFields or object ACLs to keep Relation membership confidential, such as private group memberships, block lists, or account-to-resource associations. This issue has been patched in versions 8.6.80 and 9.9.1-alpha.6.
A vulnerability in Parse Server prior to versions 8.6.80 and 9.9.1-alpha.6 allows unauthenticated clients to exploit the $relatedTo operator in relation queries. This exploitation can read the membership of Relation fields that are supposed to be protected, even when the owning object is not accessible under its ACL or class-level permissions. The vulnerability arises because the query can be executed with just public API credentials, without the need for a user session, master key, or Cloud Code. As a result, an unauthenticated client who knows the objectId of the owning object can enumerate linked objects through a protected relation or use the relation as a membership oracle to verify connections to private parents. This issue impacts applications that depend on protectedFields or object ACLs to maintain the confidentiality of Relation memberships, such as private group memberships, block lists, or account-to-resource associations.
Users can upgrade to Parse Server versions 8.6.80 or 9.9.1-alpha.6, where this vulnerability has been patched. The patch authorizes $relatedTo queries against the owning object, checking compliance with protectedFields and ACL permissions before accessing relation data. As an additional step, applications can avoid exposing sensitive Relation memberships to untrusted clients or implement access controls in a beforeFind trigger.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/pull/10493 | [email protected] | Source CodeVendor |
| https://github.com/parse-community/parse-server/pull/10494 | [email protected] | Source CodeVendor |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-wmwx-jr2p-4j4r | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Parse Server | >= 9.0.0, < 9.9.1-alpha.6 (semver) < 8.6.80 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |