Authorization bypass through user-controlled key in Parse Server - #VU152594
Published: September 28, 2026
Vulnerability identifier: #VU152594
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose protected relation membership information.
The vulnerability exists due to improper access control in the relation count query path when processing $relatedTo count queries. A remote user can submit a $relatedTo count query with an objectId constraint to disclose protected relation membership information.
Exploitation requires read access to the object owning the relation and affects fields protected for authenticated, role, or individual-user groups.
Affected software
Parse Server
Remediation
Install security update from vendor's website.
Parse Server - addressed in versions 8.6.93, 9.10.1 alpha.13