SQL Injection Vulnerability in Parse Server PostgreSQL Adapter

CVE-2026-31856

What is CVE-2026-31856?

A SQL injection vulnerability has been identified in the PostgreSQL storage adapter of Parse Server. This flaw occurs during the processing of Increment operations on nested object fields, particularly using dot notation. It stems from the improper handling of input values, which are included in SQL queries without proper parameterization or validation. Consequently, an attacker with the ability to send write requests to the Parse Server REST API can exploit this issue to inject arbitrary SQL subqueries, potentially gaining unauthorized access to database information while bypassing established Class Level Permissions (CLPs) and Access Control Lists (ACLs). It is critical for users operating affected versions of Parse Server to upgrade to versions 9.6.0-alpha.3 or 8.6.29 to mitigate this vulnerability.

References