Is CVE-2026-116801 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116801 being exploited in the wild.

How severe is CVE-2026-116801?

Medium severity, with a CVSS score of 4.3, published 27 October 2026.

Which products and versions are affected?

Parse Community Parse Server before 8.6.105; 9.0.0 before 9.10.5-alpha.6.

How is CVE-2026-116801 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116801?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116801: Parse Server $relatedTo query ACL bypass

CVE-2026-116801 · Severity: medium · CVSS 4.3 · Published 2026-10-27

Parse Server is a backend framework that manages data access through access control lists (ACLs). A flaw in relation queries allows a client with minimal read permissions to bypass ownership checks and discover which objects are linked to data they should not be able to see, leaking sensitive relationship information without modifying or deleting anything.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-116801 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116801 being exploited in the wild.
How severe is CVE-2026-116801?: Medium severity, with a CVSS score of 4.3, published 27 October 2026.
Which products and versions are affected?: Parse Community Parse Server before 8.6.105; 9.0.0 before 9.10.5-alpha.6.
Is there a fix for CVE-2026-116801?: Yes: fixed in Parse Server 8.6.105, 9.10.5-alpha.6. Until then: Add a beforeFind trigger to classes queried through a Relation field to reject $relatedTo queries where the owning objectId is not a string, including when nested in $or, $and, or $nor operators. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116801 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116801?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.105, 9.10.5-alpha.6

Add a beforeFind trigger to classes queried through a Relation field to reject $relatedTo queries where the owning objectId is not a string, including when nested in $or, $and, or $nor operators.

Technical details

Parse Server fails to validate that the owning object reference in $relatedTo relation queries is a string object ID, allowing an attacker to supply a query operator instead. This bypasses the owning-object ACL check, enabling a low-privileged client with read access to any object of the owning class to infer which readable objects are related to owning objects it cannot read. The vulnerability requires authenticated access and network connectivity but impacts only confidentiality of relationship metadata.

Affected products

Parse Community Parse Server before 8.6.105; 9.0.0 before 9.10.5-alpha.6

Timeline

2026-10-11: disclosed
2026-10-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.