Parse Server $relatedTo Query Bypasses protectedFields and ACL (CVE/CWE-639)

Vulnerability Overview Vulnerability Name: Relation query bypasses and owning-object ACL Description: Queries using the operator can read members of fields, even if those fields are hidden via , or when the object owner is not permitted to read the object under ACL or class-level permissions. The request requires only public API credentials and does not require a user session, master key, or Cloud Code. Severity: Moderate, with a CVSS v4 Base Score of 6.9/10 Affected Versions Affected Versions: - >= 9.0.0 - < 9.9.1-alpha.6 - < 8.6.80 Fixed Versions: - 9.9.1-alpha.6 - 8.6.80 Fix Details Patch: - Relation query paths now authorize the caller's access to the owning object using the caller's authentication credentials before reading the relationship join table. - Relation keys are read by the caller prior to checking the object class's . If the key is protected and the object's owner cannot read the object via class-level permissions, ACL, or pointer permissions, the query is rejected; otherwise, an empty result is returned. - Master and maintenance requests remain unaffected, and checks are consistently applied to used within , , or expressions. References GitHub security advisory Fix Parse Server 9 Fix Parse Server 8 Additional Information CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: Low - Integrity: None - Availability: None Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Weaknesses CWE-639 Credits Reporter: @tietie Coordinator: mtrizza

Goal Reached Thanks to every supporter — we hit 100%!

Parse Server $relatedTo Query Bypasses protectedFields and ACL (CVE/CWE-639)

More from this source