CVE-2026-53726: Parse Server Relation Query Bypass of Protected Fields and ACL
Summary
CVE-2026-53726: Parse Server: Relation $relatedTo query bypasses protectedFields and owning-object ACL. Affects parse across 2 version ranges.
< 8.6.80
>= 9.0.0, < 9.9.1
Fixed in 8.6.80 or 9.9.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-53726 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that allows developers to build applications with a robust server-side infrastructure. It supports various features such as data storage, user authentication, and real-time notifications. However, it has a vulnerability that affects its ability to secure relation queries, particularly when using the $relatedTo operator, which can expose sensitive information even when protected fields and ACLs are in place.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of relation queries using the $relatedTo operator in Parse Server versions prior to 8.6.80 and 9.9.1. This flaw allows an unauthenticated client to access membership information of a Relation field that should be hidden due to protectedFields settings. Even if the owning object is not readable under its ACL or class-level permissions, the attacker can enumerate linked objects by knowing the owning object's objectId. This could lead to unauthorized access to private group memberships, block lists, or other sensitive associations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.808.6.80 -
>= 9.0.0, < 9.9.19.9.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider restricting access to the API or implementing additional server-side checks to validate user permissions before processing relation queries. However, upgrading to the patched version is the recommended solution.
Conclusion
CVE-2026-53726 is a significant vulnerability in Parse Server that can expose sensitive relation memberships to unauthorized clients. It is crucial to update to the latest patched versions to mitigate this risk and ensure the confidentiality of user data.
See every vulnerability recorded for parse →
FAQ
CVE-2026-53726 is a vulnerability in Parse Server that allows unauthorized access to protected relation memberships through the $relatedTo operator.
Versions prior to 8.6.80 and 9.9.1 of Parse Server are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive information, such as private group memberships and block lists, potentially compromising user privacy.
If an immediate upgrade is not possible, implement additional server-side checks to validate user permissions for relation queries as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
