EUVD-2026-36542
GHSA-wmwx-jr2p-4j4r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no meaningful authentication barrier; confidentiality impact is limited to relation membership enumeration only, with zero integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting client by protectedFields, and even when the object owning the relation was not readable by the client under its ACL or class-level permissions. The request requires only the public API credentials that Parse clients normally carry - no user session, master key, or Cloud Code is needed. As a result, an unauthenticated client who knows or obtains the owning object's objectId could enumerate the objects linked through a protected relation, or combine the operator with an objectId constraint to use it as a membership oracle - confirming whether a specific object is linked to a private parent. This affects applications that rely on protectedFields or object ACLs to keep Relation membership confidential, such as private group memberships, block lists, or account-to-resource associations. This issue has been patched in versions 8.6.80 and 9.9.1-alpha.6.
AnalysisAI
Unauthenticated relation membership disclosure in Parse Server allows any client holding only standard public API credentials to read objects linked through a Relation field that is explicitly hidden by protectedFields, or linked to a parent object that is inaccessible under its ACL or class-level permissions. By supplying only a known or guessed owning object's objectId, a remote unauthenticated caller can enumerate all objects in a protected relation or use the $relatedTo operator as a membership oracle - confirming whether a specific child object is privately linked to a given parent. This directly undermines applications that use Parse Server's access control primitives to protect sensitive relationships such as private group memberships, block lists, or account-to-resource associations. No public exploit identified at time of analysis; vendor-released patches exist at versions 8.6.80 and 9.9.1-alpha.6.
Technical ContextAI
Parse Server (cpe:2.3:a:parse-community:parse-server) is a Node.js open-source backend platform that exposes a REST and GraphQL API with class-level permissions (CLP), per-object ACLs, and a protectedFields mechanism for hiding specific fields from designated client roles. The $relatedTo query operator traverses a many-to-many Relation join table to return child objects linked to a specified parent. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): prior to the fix, the query engine accepted a client-supplied objectId and relation key in the $relatedTo payload and consulted the join table directly without first verifying (a) whether the requested relation key was listed in protectedFields for the requesting user, or (b) whether the owning parent object was readable by the requesting user under its ACL or CLP. The fix introduced in PRs #10493 and #10494 adds an owning-object read-access gate on the relation path that must pass before the join table is consulted, and the test suite in vulnerabilities.spec.js explicitly validates denial for protected keys nested in $or, $and, and $nor compound queries as well.
RemediationAI
Upgrade Parse Server to version 8.6.80 or later on the stable line, or to 9.9.1-alpha.6 or later on the alpha line, as documented in the vendor advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-wmwx-jr2p-4j4r and implemented via PRs #10493 and #10494. If an immediate upgrade is not feasible, a partial compensating control is to deploy an API gateway or reverse proxy that rejects or sanitizes query payloads containing the $relatedTo operator - this prevents the bypass entirely but will also block all legitimate $relatedTo usage by clients, which may break application features that depend on public relation traversal. An alternative is to temporarily replace protectedFields-based access control on sensitive relation fields with more restrictive CLP find/get rules or object ACLs that deny all public reads of parent objects; however, this changes the access model broadly and may affect unrelated query types. Neither workaround fully restores the intended semantics without the patch. There are no known zero-impact workarounds.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today