Parse Server EUVD-2026-14976

Requires Parse Server versions prior to 8.6.59 or 9.6.0-alpha.53 with PostgreSQL database backend (MongoDB deployments unaffected). Attacker must possess Parse Server master key access. SQL injection via field name parameters in $group pipeline stage or distinct operation allows arbitrary PostgreSQL query execution.

While no CVSS score, CVSS vector, or EPSS probability data is published, the vulnerability's real-world risk is substantial based on available signals: the attack requires master key access (a privileged precondition that reduces likelihood for external attackers but increases insider threat risk), the technical impact is complete database compromise via arbitrary SQL execution, and the vulnerability affects a production-critical backend framework. The lack of published CVSS metrics prevents standard quantitative risk scoring, but the combination of high technical impact (database-level code execution), moderate attack complexity (requires crafted SQL metacharacters in specific pipeline stages), and the availability of patches suggests this should be treated as a high-priority remediation target for all affected PostgreSQL-backed Parse Server deployments. Organizations using Parse Server with MongoDB backends face zero risk and require no patching.

An attacker with Parse Server master key credentials (obtained through compromised credentials, insider threat, or initial compromise) crafts a malicious aggregation query containing SQL metacharacters in the field name parameter of a $group stage—for example, injecting a single quote followed by SQL commands like ' OR 1=1; DROP TABLE users; --. When this query is processed by a PostgreSQL-backed Parse Server, the unsanitized field name is embedded directly into the SQL query construction, allowing execution of arbitrary SQL statements with the database user's privileges. This permits the attacker to dump sensitive data, modify database contents, or execute operating system commands depending on PostgreSQL configuration.