CVE-2026-53726: parse-server Relation Query Bypass of Protected Fields and ACL
Summary
CVE-2026-53726: parse-server: Relation $relatedTo query bypasses protectedFields and owning-object ACL. Affects parse-server across 2 version ranges.
< 8.6.80
>= 9.0.0, < 9.9.1-alpha.6
Fixed in 8.6.80 or 9.9.1-alpha.6, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-53726 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust data storage solution. It provides features such as user authentication, data querying, and real-time notifications. However, it has a vulnerability that allows unauthorized access to sensitive data through relation queries, undermining its security model.
Vulnerability Detail
The vulnerability arises from the $relatedTo operator in Parse Server, which allows an unauthenticated client to access membership information of a Relation field, even if that field is protected by protectedFields or if the owning object is not readable under its ACL. This can lead to unauthorized enumeration of linked objects, potentially exposing private group memberships or sensitive associations.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.808.6.80npm install parse-server@8.6.80 -
>= 9.0.0, < 9.9.1-alpha.69.9.1-alpha.6npm install parse-server@9.9.1-alpha.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid exposing sensitive membership information through Relation fields to untrusted clients. Additionally, enforce access control on the queried class using a beforeFind trigger in your Parse Server code.
Conclusion
The CVE-2026-53726 vulnerability in parse-server poses a significant risk by allowing unauthorized access to sensitive data through relation queries. It is crucial to update to the patched versions or implement workarounds to mitigate the risk.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability allows unauthorized access to sensitive data through relation queries, bypassing security measures like protected fields and ACL.
Any application using parse-server versions prior to the patched versions is at risk, especially those relying on protected fields for sensitive data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
If immediate upgrading is not possible, implement the suggested workarounds to limit exposure of sensitive data until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
