Parse Server fails to validate the owning object reference used in $relatedTo relation queries. By supplying a query operator instead of a valid object ID, an attacker can bypass the owning‑object Access Control List and discover read‑accessible objects linked to inaccessible owning objects. This flaw enables an attacker to gain indirect read access to data they would normally be denied. The issue is classified as a CWE‑943: Improper Access Control Enforcement.

The vulnerability impacts Parse Server from Parse Community. Versions affected include any parse‑server release prior to 8.6.105 as well as 9.0.0 and earlier releases up to, but not including, 9.10.5‑alpha.6. All instances that expose the $relatedTo query interface are susceptible.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability is not currently listed in CISA’s KEV catalog. An attacker with read access to at least one object of the owning class can trigger the bypass by crafting a $relatedTo query that contains a query operator e.g. {$relatedTo:{operator:"$ne",…}}. In practice, this requires legitimate client access and the ability to send arbitrary queries, making the attack feasible for authenticated clients or compromised accounts. Regular review of ACLs and disabling unused query operators reduces risk.