CVE-2026-31872: Parse Server Protected Fields Bypass via Dot-Notation in Query and Sort
Summary
CVE-2026-31872: Parse Server has a protected fields bypass via dot-notation in query and sort. Affects parse across 2 version ranges.
< 8.6.32
>= 9.0.0, < 9.6.0
Fixed in 8.6.32 or 9.6.0, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-31872 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build applications with ease, leveraging Node.js for deployment. It provides features such as data storage, user authentication, and real-time capabilities. However, prior to versions 9.6.0 and 8.6.32, it had a significant security flaw related to its class-level permissions (CLP) that could be exploited by attackers.
Vulnerability Detail
The vulnerability in Parse Server arises from the ability to bypass the protectedFields class-level permission using dot-notation in query WHERE clauses and sort parameters. This flaw allows attackers to access sub-fields of protected fields, enabling them to perform a binary oracle attack to enumerate sensitive data. This issue affects both MongoDB and PostgreSQL deployments, posing a risk of unauthorized data exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.328.6.32 -
>= 9.0.0, < 9.6.09.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using dot-notation in query WHERE clauses and sort parameters for protected fields until the package can be updated to a secure version.
Conclusion
CVE-2026-31872 presents a serious security risk for applications using Parse Server versions prior to 9.6.0 and 8.6.32. It is crucial for developers to update to the latest versions to mitigate this vulnerability and protect sensitive data from unauthorized access.
See every vulnerability recorded for parse →
FAQ
CVE-2026-31872 is a vulnerability in Parse Server that allows attackers to bypass protected fields using dot-notation in queries.
Versions prior to 9.6.0 and 8.6.32 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using dot-notation in queries for protected fields as a temporary workaround.
Failing to address this vulnerability may lead to unauthorized access to sensitive data, potentially compromising user privacy and application integrity.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
