Parse Server’s protected fields enforcement fails when a protected field is wrapped inside a logical operator. As a result, any authenticated user can query and retrieve values from fields that should be hidden. The vulnerability stems from an improper validation of non‑top‑level query keys and corresponds to CWE‑284. This abuse leads to unauthorized disclosure of sensitive data but does not allow code execution or privilege escalation. The impact is limited to information disclosure for authenticated users, but the breadth of the data exposed can be large, affecting data confidentiality for all deployed services.

All releases of the open source Parse Server before version 8.6.19 and before 9.5.2‑alpha.6 are affected. The vulnerability applies to any deployment that uses the default protected field configuration, regardless of host infrastructure. Updated versions are 8.6.19 and 9.5.2‑alpha.6 (or later).

The CVSS v3 score of 7.1 indicates a high severity of design flaw. The EPSS score of less than 1% signals a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is effectively the application's query API; any authenticated user can construct a query using logical operators to trigger the bypass. Once the check is circumvented, the attacker obtains protected field data, potentially violating privacy and compliance requirements.