All vulnerabilities
CVE-2026-116164GHSA-gwrq-q25v-g8mr

parse-server: Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

parse-community parse-server
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9.10.4-alpha.3Also 8.6.100CVE List
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

Text from CVE List

Affected versions 4

  • parse-serveraffected: 9.0.0 before 9.10.4-alpha.3CVE List
  • parse-serverunaffected: 9.10.4-alpha.3CVE List
  • parse-serveraffected: all versions before 8.6.100CVE List
  • parse-serverunaffected: 8.6.100CVE List

References 2