Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116801Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

Medium 4.3

In plain English

A medium-severity security flaw in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	9.0.0 – before 9.10.5-alpha.6
parse-community	parse-server	0 – before 8.6.105

Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-58m4-cqvw-4vgh) vendor-advisory
VulnCheck Advisory: Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query third-party-advisory