CVE-2026-30962 PUBLISHED

Parse Server has a protected fields bypass via logical query operators

Assigner: GitHub_M
Reserved: 07.03.2026 Published: 10.03.2026 Updated: 11.03.2026

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values. All Parse Server deployments have default protected fields and are vulnerable. This vulnerability is fixed in 9.5.2-alpha.6 and 8.6.19.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor parse-community
Product parse-server
Versions
  • Version >= 9.0.0 < 9.5.2-alpha.6 is affected
  • Version < 8.6.19 is affected

References

Problem Types

  • CWE-284: Improper Access Control CWE