CVE-2026-109303: Authorization Bypass Through User-Controlled Key in parse-community parse-server

CVE-2026-109303 describes an authorization bypass vulnerability in parse-community's parse-server. Specifically, in versions prior to 8.6.93 and 9.0.0 before 9.10.1-alpha.13, the server does not enforce identity-scoped protectedFields (such as those scoped by authentication, role, or per-user groups) on count queries that use the $relatedTo operator. This allows an authenticated user with read access to the owning object to use count queries combined with objectId constraints as an oracle to reveal the size of protected Relation fields, effectively exposing confidential membership information like private groups or block lists.

The vulnerability allows authenticated users to bypass intended access controls on protected Relation fields by using count queries with the $relatedTo operator. This can lead to unauthorized disclosure of confidential membership information, such as private groups or block lists, which could compromise privacy or security policies relying on these protections.

A fix is available in parse-server versions 8.6.93 and 9.10.1-alpha.13 and later. Users should upgrade to these or newer versions to ensure enforcement of identity-scoped protectedFields on count queries using the $relatedTo operator. No additional mitigations are indicated by the vendor advisory.