VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026

CVE-2026-31872

CVE-2026-31872

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fixed in 9.6.0-alpha.6 and 8.6.32.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
parse-servernpm
>= 9.0.0-alpha.1, < 9.6.0-alpha.69.6.0-alpha.6
parse-servernpm
< 8.6.328.6.32

Affected products

9
  • Parseplatform/Parse Server6 versions
    cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*+ 5 more
    • cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*range: <8.6.32
    • cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:*
  • osv-coords2 versions
    pkg:bitnami/parsepkg:npm/parse-server
    < 8.6.32+ 1 more
    • (no CPE)range: < 8.6.32
    • (no CPE)range: >= 9.0.0-alpha.1, < 9.6.0-alpha.6
  • Parse Community/Parse Serverv5
    Range: >= 9.0.0 < 9.6.0-alpha.6

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.