CVE-2026-109303: Parse Server Information Disclosure Flaw

CVE-2026-109303 is an information disclosure vulnerability in Parse Server affecting versions before 8.6.93 and 9.0.0 before 9.10.1-alpha.13. It allows attackers to expose protected Relation field data through count queries. This article covers technical details, affected versions, impact, and mitigation steps.

CVE-2026-109303 Overview

CVE-2026-109303 affects Parse Server, an open-source backend framework widely used for mobile and web application development. The vulnerability allows authenticated users to bypass identity-scoped protectedFields enforcement on count queries that use the $relatedTo operator. By combining a count query with an objectId constraint, an attacker can use the response as a membership oracle to confirm whether a specific user exists in a protected Relation field. This exposes confidential membership data such as private groups, block lists, or other access-restricted collections. The flaw is tracked as an authorization bypass through user-controlled key [CWE-639].

Critical Impact
Authenticated users can enumerate confidential membership data in protected Relation fields, leaking private group members, block lists, and similar sensitive associations.

Affected Products

Parse Server versions prior to 8.6.93
Parse Server 9.0.0 through versions prior to 9.10.1-alpha.13
Applications relying on protectedFields to restrict Relation visibility

Discovery Timeline

2026-10-12 - CVE-2026-109303 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109303

Vulnerability Analysis

Parse Server supports a protectedFields configuration that restricts which fields are returned to clients based on identity scope. Scopes include authenticated users, roles, and per-user groups. The server correctly applies these restrictions on standard find and get operations against Relation fields.

The enforcement path diverges for count queries that use the $relatedTo operator. The server returns a numeric count of related objects without first checking whether the caller is authorized to view the Relation contents under the active protectedFields policy. The size of a protected Relation becomes directly observable.

A caller who can read the owning object can attach an objectId constraint to the $relatedTo query. The returned count is 1 when the specified object is a member of the Relation and 0 otherwise. This converts the count endpoint into a precise membership oracle for arbitrary identifiers.

Root Cause

The count execution path does not apply the identity-scoped protectedFields policy that governs read operations on the same Relation. The authorization check that gates field visibility is skipped when the response is a scalar count rather than object documents.

Attack Vector

An authenticated user issues a count query against a class containing a protected Relation field. The query combines $relatedTo with an objectId filter referencing the identifier they want to probe. The server returns 0 or 1, confirming non-membership or membership. Repeated queries enumerate the entire protected Relation. The vector is network-reachable and requires only low-privilege authenticated access.

See the GitHub Security Advisory GHSA-rmhf-xv62-rm99 and the VulnCheck Advisory for Parse Server for additional technical context.

Detection Methods for CVE-2026-109303

Indicators of Compromise

Repeated count queries from a single authenticated session against the same class and Relation field
Count queries using $relatedTo combined with an objectId constraint, especially iterated across many identifiers
Unusual volumes of API calls targeting classes known to contain protected Relations such as group memberships or block lists

Detection Strategies

Instrument Parse Server middleware to log all count queries that include the $relatedTo operator, capturing requesting user, target class, and query parameters
Flag sessions issuing high-cardinality enumeration patterns against the same Relation field within short time windows
Correlate count query volume against baseline application behavior to identify oracle-style probing

Monitoring Recommendations

Forward Parse Server access logs to a centralized analytics platform for query pattern analysis
Alert on sustained sequences of count operations differing only by a single objectId value
Track per-user API call ratios between standard reads and count operations against sensitive classes

How to Mitigate CVE-2026-109303

Immediate Actions Required

Upgrade Parse Server to version 8.6.93 or later on the 8.x branch
Upgrade Parse Server to version 9.10.1-alpha.13 or later on the 9.x branch
Audit application schemas to identify classes relying on protectedFields to restrict Relation visibility
Review access logs for prior enumeration patterns against sensitive Relation fields

Patch Information

The Parse Server maintainers released fixes in 8.6.93 and 9.10.1-alpha.13. The patches extend identity-scoped protectedFields enforcement to the count code path when $relatedTo is used. Deployment details are documented in the GitHub Security Advisory GHSA-rmhf-xv62-rm99.

Workarounds

Restrict Class-Level Permissions to deny count operations on classes containing sensitive Relations until the upgrade is applied
Implement a Parse Cloud Code beforeFind trigger that rejects count queries containing the $relatedTo operator from non-privileged users
Rate-limit authenticated API calls to reduce the practicality of oracle-based enumeration

bash

# Example npm upgrade command
npm install parse-server@^8.6.93
# or for the 9.x branch
npm install parse-server@9.10.1-alpha.13