Detections
Analytics

SCA: security update for parse-server (GHSA-wmwx-jr2p-4j4r)

medium Tenable Cloud Security Plugin ID 443702

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
 Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the
 membership of a Relation field even when that field was hidden from the requesting client by
 protectedFields, and even when the object owning the relation was not readable by the client under its ACL
 or class-level permissions. The request requires only the public API credentials that Parse clients
 normally carry — no user session, master key, or Cloud Code is needed. As a result, an unauthenticated
 client who knows or obtains the owning object's objectId could enumerate the objects linked through a
 protected relation, or combine the operator with an objectId constraint to use it as a membership oracle —
 confirming whether a specific object is linked to a private parent. This affects applications that rely on
 protectedFields or object ACLs to keep Relation membership confidential, such as private group
 memberships, block lists, or account-to-resource associations. This issue has been patched in versions
 8.6.80 and 9.9.1-alpha.6. (CVE-2026-53726)

Solution

Update the parse-server library and its related packages to version 8.6.80 or later.

See Also

https://github.com/advisories/GHSA-wmwx-jr2p-4j4r

Plugin Details

Severity: Medium

ID: 443702

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 6/20/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.76

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-53726

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/19/2026

Vulnerability Publication Date: 6/12/2026

Reference Information

CVE: CVE-2026-53726

cwe: CWE-639