{"id":"CVE-2026-112768","kind":"vulnerability","aliases":["CVE-2026-112768"],"related":[],"title":"Parse Server: user update leaks usernames and passwords to unauthorized callers","description":"Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.","summary":"Parse Server checks the target account's username, email and password history during a user update before it verifies the caller, and reports the result back in the response. An unauthorized caller can use this to confirm guessed usernames or emails and, when password history or username rules are enabled, guess current or previous passwords while bypassing account lockout.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend-as-a-service","node.js","package","parse-server","self-hosted"],"not_affected_if":["auth-required-user-update","patched-version"],"how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` and confirm it is not below `8.6.99` on the 8 line or `9.10.3-alpha.2` on the 9 line.\n- Look at the Parse Server config for `passwordPolicy.maxPasswordHistory` or `passwordPolicy.doNotAllowUsername`; the password guessing path needs one of them set.","fix":"- Upgrade parse-server to `8.6.99` or later on the 8.x line, or `9.10.3-alpha.2` or later on the 9.x line.","status":"open","published_at":"2026-10-19T20:17:53+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:40:43+00:00","updated_at":"2026-10-25T03:40:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:40:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade parse-server to `8.6.99` or later on the 8.x line, or `9.10.3-alpha.2` or later on the 9.x line.","reach":"internet","title":"Parse Server: user update leaks usernames and passwords to unauthorized callers","impact":"medium","summary":"Parse Server checks the target account's username, email and password history during a user update before it verifies the caller, and reports the result back in the response. An unauthorized caller can use this to confirm guessed usernames or emails and, when password history or username rules are enabled, guess current or previous passwords while bypassing account lockout.","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted","backend-as-a-service"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker guesses valid usernames and passwords without lockout","analyst_note":"","how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` and confirm it is not below `8.6.99` on the 8 line or `9.10.3-alpha.2` on the 9 line.\n- Look at the Parse Server config for `passwordPolicy.maxPasswordHistory` or `passwordPolicy.doNotAllowUsername`; the password guessing path needs one of them set.","needs_analyst":false,"not_affected_if":["patched-version","auth-required-user-update"],"who_is_affected":"Applications running Parse Server versions before 8.6.99 or 9.0.0 through 9.10.3-alpha.2 that expose the user update endpoint to callers without authorization. Username and email enumeration applies to any such deployment, while the password guessing part needs passwordPolicy.maxPasswordHistory or doNotAllowUsername to be set. Teams on patched versions or with the user endpoint locked behind authentication can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":3380,"output_tokens":667,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112768':14A,17A '-2026':13A,16A '8.6.99':93C '9.0.0':95C '9.10.3':97C 'account':36B,88B,104C,147C 'alpha.2':98C 'author':110C 'back':56B 'backend':19B 'backend-as-a-servic':18B 'bypass':87B,146C 'caller':11A,51B,62B,112C,122C 'check':33B,100C 'confirm':67B,129C 'current':82B,142C 'cve':12A,15A 'donotallowusernam':138C 'email':39B,71B,133C 'enabl':80B 'evalu':99C 'guess':68B,81B,130C,141C 'histori':42B,75B 'host':30B 'leak':5A 'lockout':89B,148C 'node.js':23B 'outcom':116C 'packag':24B 'pars':1A,26B,31B,90C 'parse-serv':25B 'password':8A,41B,74B,85B,145C 'passwordpolicy.maxpasswordhistory':136C 'previous':84B,144C 'reflect':114C 'report':53B 'respons':59B,119C 'result':55B 'rule':78B 'self':29B 'self-host':28B 'server':2A,27B,32B,91C 'servic':22B 'session':127C 'set':140C 'target':35B,103C 'unauthor':10A,61B,121C 'updat':4A,46B,108C 'use':64B 'user':3A,45B,107C 'usernam':6A,38B,69B,77B,131C 'verifi':49B 'without':125C","nicknames":[],"mitigations":[],"who_affected":"Applications running Parse Server versions before 8.6.99 or 9.0.0 through 9.10.3-alpha.2 that expose the user update endpoint to callers without authorization. Username and email enumeration applies to any such deployment, while the password guessing part needs passwordPolicy.maxPasswordHistory or doNotAllowUsername to be set. Teams on patched versions or with the user endpoint locked behind authentication can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112768","severity":null,"published_at":"2026-10-19T20:17:53+00:00","modified_at":"2026-10-19T22:17:08+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}