All vulnerabilities
CVE-2026-112768GHSA-p49q-9w65-f9p7

parse-server: Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

parse-community parse-server
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 32% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.10.3-alpha.2Also 8.6.99CVE List
Published19 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.

Text from CVE List

Affected versions 4

  • parse-serveraffected: 9.0.0 before 9.10.3-alpha.2CVE List
  • parse-serverunaffected: 9.10.3-alpha.2CVE List
  • parse-serveraffected: all versions before 8.6.99CVE List
  • parse-serverunaffected: 8.6.99CVE List

References 2