Parse Server versions before 8.6.93 and before 9.10.1‑alpha.13 fail to enforce identity‑scoped protectedFields on count queries that use the $relatedTo operator. As a result, an authenticated user who can read the owning object can count members of a protected Relation field, effectively learning how many items exist in private groups or block lists. The vulnerability exploits a design flaw in access control (CWE‑639) and yields a single data point that can be aggregated to expose confidential membership information without viewing the list itself.

The issue affects the parse‑community parse-server package. Organisations deploying Parse Server versions older than 8.6.93 or 9.10.1‑alpha.13 are impacted and must verify their deployed version before applying remediation. The vulnerability is specific to the Parse Server service and does not affect other products from Parse Platform.

The CVSS score of 5.3 places this as a medium‑severity confidentiality breach. Exploitation requires only authentication with read permissions to the owning object and the ability to craft a count query using $relatedTo. No elevated privileges are necessary. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation at this time.