---
id: "CVE-2026-112768"
kind: "vulnerability"
aliases: ["CVE-2026-112768"]
title: "Parse Server: user update leaks usernames and passwords to unauthorized callers"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backend-as-a-service", "node.js", "package", "parse-server", "self-hosted"]
not_affected_if: ["auth-required-user-update", "patched-version"]
published_at: "2026-10-19T20:17:53+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T03:40:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112768", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Parse Server: user update leaks usernames and passwords to unauthorized callers

Parse Server checks the target account's username, email and password history during a user update before it verifies the caller, and reports the result back in the response. An unauthorized caller can use this to confirm guessed usernames or emails and, when password history or username rules are enabled, guess current or previous passwords while bypassing account lockout.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Parse Server version with `npm ls parse-server` and confirm it is not below `8.6.99` on the 8 line or `9.10.3-alpha.2` on the 9 line.
- Look at the Parse Server config for `passwordPolicy.maxPasswordHistory` or `passwordPolicy.doNotAllowUsername`; the password guessing path needs one of them set.

## Fix

- Upgrade parse-server to `8.6.99` or later on the 8.x line, or `9.10.3-alpha.2` or later on the 9.x line.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112768

## From the sources

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_