CVE-2026-31872: Parse Server Protected Fields Bypass via Dot-Notation in Query and Sort
Summary
CVE-2026-31872: Parse Server has a protected fields bypass via dot-notation in query and sort. Affects parse-server across 2 version ranges.
< 8.6.32
>= 9.0.0-alpha.1, < 9.6.0-alpha.6
Fixed in 8.6.32 or 9.6.0-alpha.6, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-31872 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user authentication, and real-time notifications. However, it has a vulnerability that affects its class-level permissions, specifically the protected fields feature, which is designed to restrict access to sensitive data.
Vulnerability Detail
The vulnerability arises from a flaw in the implementation of the protectedFields class-level permission (CLP) in Parse Server. Attackers can exploit this vulnerability by using dot-notation in query WHERE clauses and sort parameters to bypass restrictions on protected fields. This allows them to query or sort by sub-fields of a protected field, leading to a binary oracle attack that can enumerate protected field values. This issue affects both MongoDB and PostgreSQL deployments, posing a significant risk to sensitive data.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.328.6.32npm install parse-server@8.6.32 -
>= 9.0.0-alpha.1, < 9.6.0-alpha.69.6.0-alpha.6npm install parse-server@9.6.0-alpha.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. The recommended action is to update to the patched versions as mentioned above.
Conclusion
CVE-2026-31872 is a critical vulnerability in Parse Server that allows attackers to bypass protections on sensitive fields. It is essential for developers using affected versions to update to the latest patched versions to safeguard their applications from potential data breaches.
See every vulnerability recorded for parse-server →
FAQ
CVE-2026-31872 is a vulnerability in Parse Server that allows attackers to bypass protected fields using dot-notation in queries and sorts.
This vulnerability can lead to unauthorized access to sensitive data, as attackers can enumerate protected field values.
Versions 9.0.0-alpha.1 to 9.6.0-alpha.5 and all versions prior to 8.6.32 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
