Executive brief
Parse Server is a backend framework that manages user data and access control for applications. A flaw in its field protection mechanism allows authenticated users to bypass security restrictions and query sensitive fields that should be hidden, potentially exposing confidential information like passwords or private user data through specially crafted database queries.
Technical details
The vulnerability is an improper access control issue (CWE-284) in Parse Server's protected fields validation logic. The validator only checks top-level query keys and does not recursively validate sub-queries wrapped in logical operators ($and, $or, etc.), allowing authenticated users to circumvent field protections. An attacker with valid credentials can wrap a protected field constraint inside a logical operator to extract sensitive field values. The fix adds recursive validation of logical operator sub-queries. Patches are available in Parse Server 8.6.19 and 9.5.2-alpha.6.
Affected products
- Parse Community Parse Server all versions before 8.6.19; 9.0.0 before 9.5.2-alpha.6
Timeline
- 2026-03-10: disclosed
- 2026-03-11: advisory
- 2026-03-11: patched: Parse Server 8.6.19 and 9.5.2-alpha.6