$relatedTo on own _User relation rejected when the relation is a protected field, ignoring protectedFieldsOwnerExempt #10816

New Issue Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Issue Description

A user can't run a $relatedTo query on a protected relation of their own _User object. protectedFieldsOwnerExempt (default true) is honoured by GET /users/me, which returns the relation to its owner, but not by the protected-field check in authorizeRelatedToQuery, added in #10493 (9.10.0).

Steps to reproduce

1. _User relation bookmarks → Layout, with "protectedFields": { "*": ["email", "bookmarks"] }.
2. Sign up a user.
3. As that user:

   curl "$SERVER/classes/Layout" -G \
     -H "X-Parse-Application-Id: $APP_ID" \
     -H "X-Parse-Session-Token: $TOKEN" \
     --data-urlencode 'where={"$relatedTo":{"object":{"__type":"Pointer","className":"_User","objectId":"'"$USER_ID"'"},"key":"bookmarks"}}'

Actual Outcome

{"code":119,"error":"Permission denied"}, the same as for any other user.

Expected Outcome

The owner gets the related objects. Possible fix (not tested): skip the check when owningClassName === '_User', protectedFieldsOwnerExempt !== false and auth.user?.id === owningId, as filterSensitiveData does.

Environment

Server

• Parse Server version: 9.10.3 (also 9.10.5, 9.10.6-alpha.5; not 9.9.0)
• Operating system: macOS 27.0.1
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): local

Database

• System (MongoDB or Postgres): MongoDB
• Database version: 7.0.34
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): local

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): REST API
• SDK version: n/a

Logs

error: This user is not allowed to query bookmarks on class _User