CVE-2026-31856

CVE-2026-31856 describes a critical SQL injection vulnerability affecting Parse Server's PostgreSQL storage adapter when processing Increment operations on nested object fields. This flaw specifically impacts Parse Server deployments using PostgreSQL, with MongoDB deployments remaining unaffected. With a CVSS score of 9.8 Critical (AV:N/AC:L/PR:N), an unauthenticated attacker can exploit this vulnerability to inject arbitrary SQL subqueries, leading to full data compromise by bypassing all confidentiality, integrity, and access controls. Despite its severe impact and ease of exploitation, there is currently no evidence of active exploitation, public exploit code availability, or significant community discussion surrounding CVE-2026-31856.