Parse Server has a protected fields bypass via logical query operators

Description

The validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values.

All Parse Server deployments have default protected fields and are vulnerable.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **< 8.6.19

  >= 9.0.0, < 9.5.2-alpha.6**

• Patched version(s): **8.6.19

  9.5.2-alpha.6**

References

• GHSA-72hp-qff8-4pvv
• CVE-2026-30962
• CWE-284
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server has a protected fields bypass via dot-notation in query and sort - CVE-2026-31872
• Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause - CVE-2026-32098
• Parse Server has a query condition depth bypass via pre-validation transform pipeline - CVE-2026-33498
• Parse Server has an auth provider validation bypass on login via partial authData - CVE-2026-33409

Tags:

npm

parse-server