Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 27 Oct 2026 04:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read. | |
| Title | Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query | |
| First Time appeared |
Parseplatform
Parseplatform parse-server |
|
| Weaknesses | CWE-943 | |
| CPEs | cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Parseplatform
Parseplatform parse-server |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-26T23:05:33.735Z
Reserved: 2026-10-26T22:13:13.605Z
Link: CVE-2026-116801
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-27T00:17:11.370
Modified: 2026-10-27T00:17:11.370
Link: CVE-2026-116801
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses