CVE-2026-31872

EPSS 0.37%
Veröffentlicht 11.03.2026 18:02:57
Zuletzt bearbeitet 13.03.2026 18:24:36
Erkennungen
Login

Parse Server has a protected fields bypass via dot-notation in query and sort

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fixed in 9.6.0-alpha.6 and 8.6.32.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

NVD 7 VulnDex Vulnerability Enrichment 2

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Parseplatform ≫ Parse-server SwPlatform node.js Version < 8.6.32

Parseplatform ≫ Parse-server SwPlatform node.js Version >= 9.0.0 < 9.6.0

Parseplatform ≫ Parse-server Version 9.6.0 Update alpha1 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.6.0 Update alpha2 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.6.0 Update alpha3 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.6.0 Update alpha4 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.6.0 Update alpha5 SwPlatform node.js

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.37%	0.283

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com	8.7	0	0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X