CVE-2026-31872: Parse Server has a protected fields bypass via dot-notation in query and sort
Impact
The protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values.
This affects both MongoDB and PostgreSQL deployments.
Patches
The fix ensures that query WHERE clause keys and sort keys are checked against protected fields by extracting the root field from dot-notation paths. For example, a query on secretObj.apiKey is now correctly blocked when secretObj is a protected field.
Workarounds
None.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-r2m8-pxm9-9c4g - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.6 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.32
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fixed in 9.6.0-alpha.6 and 8.6.32.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31872?
CVE-2026-31872 has a high severity rating due to its potential for bypassing class-level permissions and enabling unauthorized data access.
How do I fix CVE-2026-31872?
To mitigate CVE-2026-31872, upgrade to Parse Server version 8.6.32 or 9.6.0-alpha.6 or later, ensuring the vulnerability is patched.
What software is affected by CVE-2026-31872?
CVE-2026-31872 affects Parse Server versions prior to 8.6.32 and between 9.0.0-alpha.1 and 9.6.0-alpha.6.
What type of attack is enabled by CVE-2026-31872?
CVE-2026-31872 allows for a binary oracle attack through the use of dot-notation in queries on protected fields.
What is the impact of CVE-2026-31872?
The impact of CVE-2026-31872 includes unauthorized access to sensitive data and the enumeration of protected field values.