Live › vulnerability › CVE-2026-116801
Go to dashboardParse Server does not validate the owning object ID in $relatedTo relation queries, so passing a query operator in place of an ID bypasses the owner's ACL check. A client with read access to one object of the owning class can learn which readable objects link to owners it cannot read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Applications running Parse Server before 8.6.105 or 9.0.0 before 9.10.5-alpha.6 that expose $relatedTo relation queries to clients with read access to at least one object of a class that has owning-object ACLs. Teams on other versions, or on managed hosting that has already patched, can skip it. unknown whether the sources name specific deployment patterns beyond this.
No product ranges from the sources yet.
npm ls parse-server and compare it to 8.6.105 (8.x line) or 9.10.5-alpha.6 (9.x line)8.6.105 or later on the 8.x line, or to 9.10.5-alpha.6 or later on the 9.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.
This page as .md · .json · in your agent: get_signal("CVE-2026-116801")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.