A relation query using the $relatedTo operator in Parse Server can read the membership of a Relation field even when the field is hidden by protectedFields and even when the owning object is not readable by the client under its ACL or class-level permissions. The attacker only requires the public API credentials that Parse clients normally carry and can enumerate objects linked through a protected relation or confirm whether a specific object is linked to a private parent. This enables the unauthorized disclosure of sensitive information such as private group memberships, block lists, or account-to-resource associations.

Applications running parse-community parse-server versions prior to 8.6.80 or 9.9.1-alpha.6 are affected. The vulnerability applies to any deployment of Parse Server that relies on protectedFields or object ACLs to keep Relation membership confidential.

The CVSS score of 6.9 places the issue in the medium severity range, but the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA's KEV catalog, suggesting no widespread exploitation has been reported. An unauthenticated attacker with knowledge or guess of an owning object's objectId can exploit the flaw by making a $relatedTo query, which serves as a membership oracle for private data. The attack vector is straightforward and requires no special privileges beyond the public API key.