CVE-2026-116801 in parse-server
Summary
by MITRE • 10/27/2026
Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Parse Server versions prior to 8.6.105 and 9.0.0 before 9.10.5-alpha.6 represents a critical failure in access control validation within the query processing engine, specifically concerning relational data structures. This flaw stems from an insufficient input sanitization mechanism when handling $relatedTo relation queries. In typical database operations involving Parse Server, objects are often linked through relations where one object owns another, and strict Access Control Lists govern who can read or write to these entities. The security architecture relies on the server validating that a client requesting data related to a specific owning object actually possesses valid permissions for that owner before returning any associated child records. However, in this vulnerable state, the system fails to rigorously validate the type of reference provided for the owning object within the query parameters.
The technical core of the exploit lies in the ability of an attacker to supply a query operator instead of a standard object identifier when constructing a $relatedTo query. Normally, such queries require a specific Object ID to target a particular record and check its associated permissions. By injecting a query operator, which is intended for filtering logic rather than entity targeting, the application bypasses the expected ownership verification step. The server processes this malformed request without triggering the necessary ACL checks that would normally restrict access based on the owning object's security settings. This deviation from standard validation protocols allows the database engine to execute the relational lookup against a broader or different set of records than intended by the security model, effectively treating the operator injection as a valid reference point for permission evaluation.
The operational impact of this vulnerability is significant data disclosure and potential unauthorized access to sensitive information. An attacker who has read access to at least one object within an owning class can leverage this flaw to enumerate and disclose which readable objects are linked to owning objects that they do not have explicit permissions to view. This creates a side-channel attack vector where the mere existence of relationships between restricted resources becomes visible, even if the content of those restricted resources remains hidden. For applications handling sensitive user data or proprietary information, this leakage can facilitate further reconnaissance attacks, allowing adversaries to map out the internal structure of the database and identify high-value targets that were previously obscured by access controls.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure to enforce proper restrictions on authenticated users' ability to access specific resources or perform actions. Furthermore, from an adversary perspective, this technique corresponds to ATT&CK T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie if the session tokens are derived from such disclosures, though primarily it falls under information discovery techniques that exploit misconfigured permissions. The exploitation does not require complex privilege escalation but rather a precise manipulation of query syntax to bypass existing security boundaries.
To mitigate this risk, organizations must immediately upgrade Parse Server to version 8.6.105 or later for the legacy branch, and version 9.10.5-alpha.6 or later for the development branch. These updates include patches that enforce strict type checking on owning object references within relation queries, ensuring that only valid Object IDs are processed without bypassing ACL checks. Additionally, developers should implement defense-in-depth strategies by validating input types at the application layer before they reach the database query engine. Regular security audits and static code analysis focused on access control logic can help identify similar weaknesses in custom implementations or extensions of the Parse framework. Monitoring logs for unusual query patterns involving relational operators may also aid in detecting attempted exploitation in real-time environments where patching is delayed.