Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M

CVE-2026-30962Parse Server has a protected fields bypass via logical query operators

High 7.1

In plain English

A high-severity improper access control in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values. All Parse Server deployments have default protected fields and are vulnerable. This vulnerability is fixed in 9.5.2-alpha.6 and 8.6.19.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	parse-server	9.5.2-alpha.6	GHSA-72hp-qff8-4pvv
npm	parse-server	8.6.19	GHSA-72hp-qff8-4pvv

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	>= 9.0.0 < 9.5.2-alpha.6< 8.6.19

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv x_refsource_CONFIRM
https://github.com/parse-community/parse-server/releases/tag/8.6.19 x_refsource_MISC
https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.6 x_refsource_MISC