{"id":"CVE-2026-53726","title":"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL","summary":"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL","severity":"medium","cwe":["CWE-639"],"vendor":"parse-server","product":"parse-server","affected":["parse-server >= 9.0.0, < 9.9.1-alpha.6","parse-server < 8.6.80"],"patched":["parse-server 9.9.1-alpha.6","parse-server 8.6.80"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wmwx-jr2p-4j4r","references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-wmwx-jr2p-4j4r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53726"},{"url":"https://github.com/parse-community/parse-server/pull/10493"},{"url":"https://github.com/parse-community/parse-server/pull/10494"},{"url":"https://github.com/advisories/GHSA-wmwx-jr2p-4j4r"}],"tags":["ghsa","npm"],"epss":0.00276,"epssPercentile":0.20317,"ingestedAt":"2026-06-22T15:52:21.057Z","ecosystem":"npm","slug":"CVE-2026-53726","body":"## Overview\n\n### Impact\n\nA relation query using the `$relatedTo` operator could read the membership of a `Relation` field even when that field was hidden from the requesting client by `protectedFields`, and even when the object owning the relation was not readable by the client under its ACL or class-level permissions. The request requires only the public API credentials that Parse clients normally carry — no user session, master key, or Cloud Code is needed.\n\nAs a result, an unauthenticated client who knows or obtains the owning object's `objectId` could enumerate the objects linked through a protected relation, or combine the operator with an `objectId` constraint to use it as a membership oracle — confirming whether a specific object is linked to a private parent. This affects applications that rely on `protectedFields` or object ACLs to keep `Relation` membership confidential, such as private group memberships, block lists, or account-to-resource associations.\n\n### Patches\n\nThe relation query path now authorizes `$relatedTo` against the owning object before reading the relation join table, using the caller's authentication context. The relation key is checked against the owning class's `protectedFields` (the query is rejected if the key is protected), and the owning object must be readable by the caller under its class-level permissions, ACL, and pointer permissions; otherwise the relation returns no results. Master and maintenance requests are unaffected. The check is applied consistently whether `$relatedTo` is used at the top level or nested within `$or`, `$and`, or `$nor`.\n\n### Workarounds\n\nThere is no complete workaround without upgrading. As mitigation, applications can avoid exposing sensitive membership through `Relation` fields to untrusted clients, or enforce access on the queried class in a `beforeFind` trigger.\n\n## Affected packages\n\n- `parse-server >= 9.0.0, < 9.9.1-alpha.6`\n- `parse-server < 8.6.80`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `parse-server 9.9.1-alpha.6`\n- `parse-server 8.6.80`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}