CVE-2026-30962: Parse Server has a protected fields bypass via logical query operators
Impact
The validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values.
All Parse Server deployments have default protected fields and are vulnerable.
Patches
The fix adds recursive validation of sub-queries with logical operators, consistent with the existing recursive validation patterns.
Workarounds
Use a beforeFind trigger on affected classes to manually inspect the query for protected field references in logical operator sub-queries and reject the request.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.6 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.19
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values. All Parse Server deployments have default protected fields and are vulnerable. This vulnerability is fixed in 9.5.2-alpha.6 and 8.6.19.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30962?
CVE-2026-30962 is considered high severity due to the potential for authenticated users to bypass protected field restrictions.
How do I fix CVE-2026-30962?
To fix CVE-2026-30962, upgrade your Parse Server to version 8.6.19 or 9.5.2-alpha.6 or later.
What type of vulnerability is CVE-2026-30962?
CVE-2026-30962 is a logic bypass vulnerability affecting the validation of protected fields in Parse Server.
Who is affected by CVE-2026-30962?
All users of Parse Server versions prior to 8.6.19 and between 9.0.0 and 9.5.2-alpha.6 are affected by CVE-2026-30962.
Can CVE-2026-30962 be exploited by unauthenticated users?
No, CVE-2026-30962 requires authentication, allowing only authenticated users to potentially exploit the vulnerability.