https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T19:19:18.348851+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-31872 CVE-2026-31872 — Parse Server has a protected fields bypass via dot-notation in query and sort 2026-10-15T19:19:18.374075+00:00

Affected: parse-community parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fixed in 9.6.0-alpha.6 and 8.6.32.