Parse Server has a protected fields bypass via dot-notation…(CVE-2026-31872)

概要

Parse Server has a protected fields bypass via dot-notation in query and sort

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fixed in 9.6.0 and 8.6.32.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami parse

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.6.32"},{"introduced":"9.0.0"},{"fixed":"9.6.0"}]}]

概要

原文の説明

影響パッケージ

参照URL