中 5.3

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object...

CVE-2026-116801 SecPulse初出 8:05

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
parse-community	parse-server	8.6.105 未満	8.6.105

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to at least one object of the owning class can disclose which readable objects are linked to owning objects it cannot read.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web disclosure@vulncheck.com
web disclosure@vulncheck.com
web nvd.nist.gov
web github.com