Is CVE-2026-109303 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109303 being exploited in the wild.

How severe is CVE-2026-109303?

Medium severity, with a CVSS score of 4.3, published 12 October 2026.

Which products and versions are affected?

Parse Community Parse Server 8.0.0 through 8.6.92; 9.0.0 through 9.10.1-alpha.12.

How is CVE-2026-109303 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109303?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109303: Parse Server protectedFields bypass in relation count queries

CVE-2026-109303 · Severity: medium · CVSS 4.3 · Published 2026-10-12

Parse Server is a backend-as-a-service platform that manages data access and permissions for applications. An authenticated user can bypass access controls on sensitive relation fields (such as group memberships or block lists) by using count queries with specific operators, allowing them to discover confidential information like who is in a private group. This affects applications that rely on Parse Server's permission system to keep relationship data private from logged-in users.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-109303 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109303 being exploited in the wild.
How severe is CVE-2026-109303?: Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?: Parse Community Parse Server 8.0.0 through 8.6.92; 9.0.0 through 9.10.1-alpha.12.
Is there a fix for CVE-2026-109303?: Yes: fixed in Parse Server 8.6.93, 9.10.1-alpha.13. Until then: Applications can protect sensitive Relation fields for the public group in addition to identity-scoped groups, deny the count class-level permission on the related class for untrusted users, or enforce access in a beforeFind trigger. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109303 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109303?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.93, 9.10.1-alpha.13

Applications can protect sensitive Relation fields for the public group in addition to identity-scoped groups, deny the count class-level permission on the related class for untrusted users, or enforce access in a beforeFind trigger.

Technical details

The vulnerability stems from incomplete enforcement of identity-scoped protectedFields rules on count queries using the $relatedTo operator. While access controls were applied to find queries, they were not enforced on the count path for authenticated, role-based, or per-user protected relations. An authenticated attacker with read access to an owning object can combine relation counts with objectId constraints to function as a membership oracle, revealing protected Relation field membership without proper authorization.

Affected products

Parse Community Parse Server 8.0.0 through 8.6.92; 9.0.0 through 9.10.1-alpha.12

Timeline

2026-09-22: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.