CVE-2026-109303

4.3Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-639

Impact

Authenticated attackers can determine membership in sensitive lists (like private groups or block lists) using count queries as an oracle. They need read access to the owning object and valid credentials on the server.

Root cause

Count queries using the $relatedTo operator fail to enforce identity-scoped protectedFields configurations.

Affected systems

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Parse Server to version 8.6.93 or 9.10.1-alpha.13 or later. No interim configuration mitigation is specified, so restrict read permissions on owning objects if patching is delayed.

shell

$ npm install parse-server@latest

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can combine counts with an objectId constraint as a membership oracle to reveal confidential memberships such as private groups or block lists.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109303