CVE-2026-116801

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.105 Parse Server versions 9.0.0 through 9.10.5-alpha.5

Description Insufficient validation of the owning object reference in $relatedTo relation queries allows a user to bypass the owning-object Access Control List (ACL) check by providing a query operator instead of an object ID. This enables a client with read access to at least one object of the owning class to discover which readable objects are linked to owning objects they are not authorized to read.

Recommendations Update Parse Server to version 8.6.105 or later. Update Parse Server to version 9.10.5-alpha.6 or later.