SQL Injection Vulnerability in Parse Server PostgreSQL Storage Adapter
CVE-2026-31871

9.3CRITICAL

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
11 March 2026

What is CVE-2026-31871?

A SQL injection vulnerability exists within the PostgreSQL storage adapter of Parse Server, affecting versions prior to 9.6.0-alpha.5 and 8.6.31. This flaw arises when handling Increment operations on nested object fields via dot notation, allowing attackers to inject arbitrary SQL through crafted sub-key names containing single quotes. Such actions not only enable potential command execution but also facilitate unauthorized data access by bypassing Class Level Permissions (CLPs) and Access Control Lists (ACLs). It is important for users deploying Parse Server with PostgreSQL to upgrade to the latest versions to mitigate these risks.

Affected Version(s)

parse-server >= 9.0.0 < 9.6.0-alpha.5 < 9.0.0 9.6.0-alpha.5

parse-server < 8.6.31 < 8.6.31

References

https://github.com/parse-community/parse-server/security/...
x_refsource_CONFIRM
https://github.com/parse-community/parse-server/releases/...
x_refsource_MISC
https://github.com/parse-community/parse-server/releases/...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.