8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31872

CVE-2026-31872: Parse Server has a protected fields bypass via dot-notation in query and sort

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fixed in 9.6.0-alpha.6 and 8.6.32.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31872

CVE-2026-31872:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0-alpha.1, < 9.6.0-alpha.6	9.6.0-alpha.6
parse-server	npm	< 8.6.32	8.6.32

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows bypassing protected field restrictions using dot-notation in query WHERE clauses and sort parameters. The provided commit 1787db3 directly addresses this. The changes are located in the _UnsafeRestQuery.prototype.denyProtectedFields function within src/RestQuery.js. The patch modifies this function to correctly parse and check fields with dot-notation and adds a new check for sort parameters. Previously, the function only checked for top-level fields in the where clause, which was insufficient. Therefore, _UnsafeRestQuery.denyProtectedFields is the function that contained the flawed logic and is the vulnerable function that would be on the stack during exploitation.

Vulnerable functions

_UnsafeRestQuery.denyProtectedFields

src/RestQuery.js

The function `_UnsafeRestQuery.prototype.denyProtectedFields` in `src/RestQuery.js` is responsible for enforcing restrictions on protected fields in database queries. Before the patch, it only checked for the presence of a protected field as a top-level key in the `where` clause of a query. It did not inspect for dot-notation access (e.g., `protectedField.subfield`) and completely omitted checks on sort parameters. This allowed an attacker to construct queries that sorted or filtered by sub-fields of a protected field, creating a boolean oracle to leak sensitive information. The patch rectifies this by splitting query and sort keys by the dot character to check the root field against the list of protected fields.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.