Live › vulnerability › CVE-2026-112768
Go to dashboardParse Server checks the target account's username, email and password history during a user update before it verifies the caller, and reports the result back in the response. An unauthorized caller can use this to confirm guessed usernames or emails and, when password history or username rules are enabled, guess current or previous passwords while bypassing account lockout.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Parse Server versions before 8.6.99 or 9.0.0 through 9.10.3-alpha.2 that expose the user update endpoint to callers without authorization. Username and email enumeration applies to any such deployment, while the password guessing part needs passwordPolicy.maxPasswordHistory or doNotAllowUsername to be set. Teams on patched versions or with the user endpoint locked behind authentication can skip it.
No product ranges from the sources yet.
npm ls parse-server and confirm it is not below 8.6.99 on the 8 line or 9.10.3-alpha.2 on the 9 line.passwordPolicy.maxPasswordHistory or passwordPolicy.doNotAllowUsername; the password guessing path needs one of them set.8.6.99 or later on the 8.x line, or 9.10.3-alpha.2 or later on the 9.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
This page as .md · .json · in your agent: get_signal("CVE-2026-112768")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.