Executive brief
Parse Server is a backend-as-a-service platform that manages application data and user authentication. An administrator with elevated access can inject malicious SQL commands through aggregate and distinct query parameters, gaining direct database access and potentially extracting or modifying all stored data. This vulnerability only affects deployments using PostgreSQL databases; MongoDB installations are not impacted.
Technical details
The vulnerability is a SQL injection (CWE-89) in Parse Server's PostgreSQL storage adapter. Attackers with master key credentials can inject SQL metacharacters into field name parameters within the aggregate $group pipeline stage or distinct dot-notation parameters. These field names are interpolated directly into SQL queries without sanitization, allowing arbitrary SQL execution. The attack requires master key access (high privilege) and network connectivity to the Parse Server application. An attacker can execute any SQL statement against the PostgreSQL database, achieving privilege escalation from application-level administrator to database-level access. Patches are available in versions 8.6.59 and 9.6.0-alpha.53 and later, which validate field names to contain only alphanumeric characters and underscores.
Affected products
- Parse Community Parse Server All versions < 8.6.59, and >= 9.0.0 < 9.6.0-alpha.53
Timeline
- 2026-03-24: disclosed
- 2026-03-24: patched: Fixes released in versions 8.6.59 and 9.6.0-alpha.53