CVE-2026-53726

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.80 Parse Server versions prior to 9.9.1-alpha.6

Description A relation query using the $relatedTo operator allows an unauthenticated client to read the membership of a Relation field. This occurs even if the field is hidden by protectedFields or if the object owning the relation is restricted by Access Control Lists (ACL) or class-level permissions. An attacker with the objectId of the owning object can enumerate linked objects or use the operator as a membership oracle to confirm if a specific object is linked to a private parent. This affects applications using protectedFields or ACLs to keep data confidential, such as block lists or private group memberships.

Recommendations Update to version 8.6.80. Update to version 9.9.1-alpha.6.