Parse Server CVE-2026-116801

Requires an authenticated client (PR:L) that already holds read access to at least one object of the owning class, and a target class that exposes a Relation field queried via $relatedTo. Exploitation consists of supplying a query operator (non-string value) in place of the owning-object objectId - including when nested inside $or, $and, or $nor - to bypass the owning-object ACL check added for GHSA-wmwx-jr2p-4j4r. Limiting factors: only objects the attacker can already read are returned (so this discloses cross-ACL linkage/relationship membership, not the contents of unreadable owning objects); impact is read-only (no integrity or availability effect); and it is confined to applications that use Relation fields and expose them to query. The workaround is a beforeFind trigger on relation-queried classes that rejects $relatedTo queries whose owning objectId is not a string; the complete fix is updating to a patched version.

This is a moderate, low-urgency information-disclosure flaw rather than a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with vulnerable-system confidentiality only (VC:L, VI:N, VA:N) and a base score of 5.3 describes a network-reachable but authenticated issue with limited, read-only impact - consistent with the description, which requires a client that already has read access to at least one object of the owning class and only leaks the linkage of objects the attacker could already read. The signals align rather than conflict: EPSS is low (0.25%, 17th percentile), the CVE is NOT on CISA KEV, and the CISA SSVC framework records Exploitation: none, Automatable: no, Technical Impact: partial. The vuln.today decision label is 'this_month,' indicating a patch-in-normal-cycle priority, not an emergency. There are no indications of active exploitation or weaponization. In short, this is a legitimate but bounded ACL-bypass/information-disclosure bug (a regression around the owning-object authorization previously added for GHSA-wmwx-jr2p-4j4r), appropriate to remediate on a routine patch cadence rather than as a crisis.

An authenticated low-privilege client of a Parse Server application that holds read access to at least one object of a class exposing a Relation field sends a $relatedTo relation query in which the owning-object reference is a query operator rather than a concrete objectId. Because the owning-object ACL check is bypassed, the server returns which readable objects are linked to owning objects the attacker is not permitted to read, disclosing relationship/linkage information across ACL boundaries. No public exploit identified at time of analysis; a vendor (VulnCheck) and GHSA advisory describe the mechanism but no verified working exploit code is provided.