ACL Bypass in Parse Server by Parse Community
CVE-2026-116801

5.3MEDIUM

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116801?

An access control list (ACL) bypass vulnerability exists in Parse Server versions prior to 9.10.5-alpha.6. This issue arises from the failure to properly validate the owning object reference in $relatedTo relation queries. As a result, attackers can bypass the ACL checks by supplying a query operator instead of a legitimate object ID. A malicious client that has read access to at least one object of the owning class could exploit this vulnerability to disclose the readable objects that link to owning objects they do not have permission to access.

Affected Version(s)

parse-server 9.0.0 < 9.10.5-alpha.6

parse-server 0 < 8.6.105

parse-server 9.10.5-alpha.6

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-9.0.0-b...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tan-JunWei
mtrezza
.