Executive brief
Parse Server is a backend-as-a-service platform that manages data access controls for mobile and web applications. An attacker can bypass field-level access restrictions (protectedFields) by using dot-notation in database queries, allowing them to enumerate sensitive data values through a binary oracle attack. This affects all deployments using MongoDB or PostgreSQL.
Technical details
The vulnerability is an access control bypass (CWE-284) in Parse Server's query filtering and sorting logic. Protected fields defined via class-level permissions (CLP) can be circumvented by querying or sorting on nested sub-fields using dot-notation (e.g., "secretObj.apiKey" when "secretObj" is protected). This enables unauthenticated attackers on the network to perform binary oracle attacks and extract protected field values without authentication. The fix validates that query WHERE clause keys and sort parameters are checked against protected fields by extracting the root field from dot-notation paths. Patches are available in version 8.6.32 and 9.6.0-alpha.6.
Affected products
- Parse Community Parse Server all versions prior to 8.6.32; versions 9.0.0-alpha.1 through 9.6.0-alpha.5
Timeline
- 2026-03-11: disclosed
- 2026-03-11: patched: Patches released: Parse Server 8.6.32 and 9.6.0-alpha.6