7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30962

CVE-2026-30962: Parse Server has a protected fields bypass via logical query operators

Impact

The validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is bypassed entirely. This allows any authenticated user to query on protected fields to extract field values.

All Parse Server deployments have default protected fields and are vulnerable.

Patches

The fix adds recursive validation of sub-queries with logical operators, consistent with the existing recursive validation patterns.

Workarounds

Use a beforeFind trigger on affected classes to manually inspect the query for protected field references in logical operator sub-queries and reject the request.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.6
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.19

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30962

CVE-2026-30962:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.5.2-alpha.6	9.5.2-alpha.6
parse-server	npm	< 8.6.19	8.6.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as a protected fields bypass, allows authenticated users to query for protected fields by nesting the query within a logical operator like $or, $and, or $nor. The security advisory and commit logs point to a fix that implements recursive validation of sub-queries.

The analysis of the provided patch commit 2c11c61 confirms this. The changes are in src/RestQuery.js, specifically within the _UnsafeRestQuery.prototype.denyProtectedFields function. Before the patch, this function iterated over protected fields and checked for their presence only in the top-level restWhere object. The patch replaces this with a recursive function, checkWhere, which traverses the query structure, including arrays within $or, $and, and $nor operators, to ensure no protected fields are being queried at any level. Therefore, _UnsafeRestQuery.denyProtectedFields is the function that contained the vulnerability.

Vulnerable functions

_UnsafeRestQuery.denyProtectedFields

src/RestQuery.js

The vulnerability lies in the `_UnsafeRestQuery.denyProtectedFields` function, which was responsible for checking for queries against protected fields. The original implementation only checked for protected fields at the top level of the query's `where` clause. It did not recursively inspect nested query conditions within logical operators such as `$or`, `$and`, or `$nor`. This allowed an attacker to bypass the protection by wrapping a query for a protected field within one of these logical operators, thereby gaining unauthorized access to protected data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.