CVE-2026-116801: Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

Q: Which deployments are affected?

Parse Server versions before 8.6.105 are affected, as are versions from 9.0.0 through before 9.10.5-alpha.6. The issue applies where clients can issue $relatedTo relation queries against classes protected by object ACLs.

Q: What does an attacker need to exploit this issue?

The attacker needs network access and credentials or other access allowing them to read at least one object in the owning class. They can supply a query operator in place of the owning object ID in a $relatedTo query.

Q: What information can be exposed?

An attacker can determine which objects they can read are linked to owning objects that they are not permitted to read. The provided information describes disclosure only; it does not indicate integrity or availability impact.

Q: How can the issue be remediated?

Upgrade Parse Server to 8.6.105 or later on the 8.x line, or to 9.10.5-alpha.6 or later on the 9.x line.

Published Oct 26, 2026

Updated

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.

Affected Software

1 affected component

Parse Platform Parse Server<8.6.105, >=9.0.0<9.10.5-alpha.6

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Parse Server versions before 8.6.105 are affected, as are versions from 9.0.0 through before 9.10.5-alpha.6. The issue applies where clients can issue $relatedTo relation queries against classes protected by object ACLs.

What does an attacker need to exploit this issue?

The attacker needs network access and credentials or other access allowing them to read at least one object in the owning class. They can supply a query operator in place of the owning object ID in a $relatedTo query.

What information can be exposed?

An attacker can determine which objects they can read are linked to owning objects that they are not permitted to read. The provided information describes disclosure only; it does not indicate integrity or availability impact.

How can the issue be remediated?

Upgrade Parse Server to 8.6.105 or later on the 8.x line, or to 9.10.5-alpha.6 or later on the 9.x line.

CVE-2026-116801: Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be exposed?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be exposed?

How can the issue be remediated?