Live › vulnerability › CVE-2026-116164
Go to dashboardParse Server does not reject reserved internal field names in client object writes, so a client can store or clear internal fields. An attacker can write a reserved field that makes object reads fail on MongoDB, disrupting queries for that class, or clear their own lockout state and password history to bypass lockout and password policy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Applications running Parse Server versions before 8.6.100 or in the 9.0.0 to 9.10.4-alpha.2 range, where clients can write objects directly through the Parse API. Exposure depends on whether untrusted clients can write objects, so apps whose writes all go through trusted server code are less exposed. unknown whether other database backends are affected.
No product ranges from the sources yet.
npm ls parse-server or by reading version in node_modules/parse-server/package.json.8.6.100 or later on the 8.x line.9.10.4-alpha.3 or later on the 9.x line; 9.0.0 through 9.10.4-alpha.2 are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.
This page as .md · .json · in your agent: get_signal("CVE-2026-116164")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.