Parse Server, an open‑source backend for Node.js, enforces protectedFields through a class‑level permission (CLP). A flaw in versions prior to 9.6.0‑alpha.6 and 8.6.32 allows an attacker to use dot‑notation within query WHERE clauses and sort parameters to reference sub‑fields of a protected field, effectively bypassing the CLP. This results in a binary oracle that can enumerate the true values of fields that should remain hidden, thereby compromising data confidentiality. The vulnerability is classified as CWE‑284 – Improper Control of Access Permissions.

All installations of parse-community:parse-server running on Node.js are affected when the deployed version is older than 9.6.0‑alpha.6 or 8.6.32. Both MongoDB and PostgreSQL database backends are susceptible, as the issue lies in the query processing layer rather than the database itself. The CPE entries confirm that any 9.6.0-alpha and 8.6.32 releases are impacted.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of under 1 % suggests current exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the publicly exposed Parse Server API and does not necessitate authentication; an attacker can craft a query or sort string using dot‑notation to extract protected data. The lack of authentication requirements elevates risk for exposed deployments.