SB20260928325 - Authorization bypass through user-controlled key in Parse Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260928325

SB20260928325 - Authorization bypass through user-controlled key in Parse Server

Published: September 28, 2026

Security Bulletin ID SB20260928325
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose protected relation membership information.

The vulnerability exists due to improper access control in the relation count query path when processing $relatedTo count queries. A remote user can submit a $relatedTo count query with an objectId constraint to disclose protected relation membership information.

Exploitation requires read access to the object owning the relation and affects fields protected for authenticated, role, or individual-user groups.


Remediation

Install update from vendor's website.

References