CVE-2026-109303

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.93 Parse Server versions 9.0.0 through 9.10.1-alpha.12

Description Identity-scoped protectedFields (including authenticated, role, or per-user groups) are not enforced on count queries that utilize the $relatedTo operator. This allows an authenticated user with read access to the owning object to use counts combined with an objectId constraint as a membership oracle, potentially revealing the size of protected Relation fields and confidential memberships, such as block lists or private groups.

Recommendations Update Parse Server to version 8.6.93 or later. Update Parse Server to version 9.10.1-alpha.13 or later.