{"id":"CVE-2026-116164","kind":"vulnerability","aliases":["CVE-2026-116164"],"related":[],"title":"Parse Server: client writes to reserved internal fields break reads and lockouts","description":"Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.","summary":"Parse Server does not reject reserved internal field names in client object writes, so a client can store or clear internal fields. An attacker can write a reserved field that makes object reads fail on MongoDB, disrupting queries for that class, or clear their own lockout state and password history to bypass lockout and password policy.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mongodb","node","package","parse-server","self-hosted"],"not_affected_if":["patched-version","server-side-only-writes"],"how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` or by reading `version` in `node_modules/parse-server/package.json`.\n- Check whether the app uses MongoDB as its database.","fix":"- Upgrade parse-server to `8.6.100` or later on the 8.x line.\n- Upgrade parse-server to `9.10.4-alpha.3` or later on the 9.x line; `9.0.0` through `9.10.4-alpha.2` are affected.","status":"open","published_at":"2026-10-25T14:16:55+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:42:50+00:00","updated_at":"2026-10-25T14:42:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade parse-server to `8.6.100` or later on the 8.x line.\n- Upgrade parse-server to `9.10.4-alpha.3` or later on the 9.x line; `9.0.0` through `9.10.4-alpha.2` are affected.","reach":"internet","title":"Parse Server: client writes to reserved internal fields break reads and lockouts","impact":"medium","summary":"Parse Server does not reject reserved internal field names in client object writes, so a client can store or clear internal fields. An attacker can write a reserved field that makes object reads fail on MongoDB, disrupting queries for that class, or clear their own lockout state and password history to bypass lockout and password policy.","category":"package","nicknames":[],"who_cares":["parse-server","node","mongodb","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker breaks class queries and bypasses account lockout and password policy","analyst_note":"Check the Parse Server advisory or release notes for the exact fixed versions and whether non-MongoDB backends are affected; sources only give the NVD description.","how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` or by reading `version` in `node_modules/parse-server/package.json`.\n- Check whether the app uses MongoDB as its database.","needs_analyst":true,"not_affected_if":["patched-version","server-side-only-writes"],"who_is_affected":"Applications running Parse Server versions before 8.6.100 or in the 9.0.0 to 9.10.4-alpha.2 range, where clients can write objects directly through the Parse API. Exposure depends on whether untrusted clients can write objects, so apps whose writes all go through trusted server code are less exposed. unknown whether other database backends are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3362,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116164':15A,18A '-2026':14A,17A '8.6.100':87C '9.0.0':89C '9.10.4':91C 'account':139C 'allow':104C 'alpha.3':92C 'attack':51B,112C 'break':9A 'bypass':79B,146C 'class':68B,131C 'clear':47B,70B,109C,136C 'client':3A,38B,43B,101C,105C 'cve':13A,16A 'disrupt':64B,127C 'fail':61B,124C 'field':8A,35B,49B,56B,98C,111C,117C 'histori':77B,144C 'host':27B 'intern':7A,34B,48B,97C,110C 'lockout':12A,73B,80B,140C,147C 'make':58B,119C 'mongodb':19B,63B,126C 'name':36B,99C 'node':20B 'object':39B,59B,102C,123C 'packag':21B 'pars':1A,23B,28B,84C 'parse-serv':22B 'password':76B,82B,143C,149C 'polici':83B,150C 'queri':65B,128C 'read':10A,60B,120C 'reject':32B,95C 'reserv':6A,33B,55B,96C,116C 'self':26B 'self-host':25B 'server':2A,24B,29B,85C 'state':74B,141C 'store':45B,107C 'user':134C 'write':4A,40B,53B,103C,114C","nicknames":[],"mitigations":[],"who_affected":"Applications running Parse Server versions before 8.6.100 or in the 9.0.0 to 9.10.4-alpha.2 range, where clients can write objects directly through the Parse API. Exposure depends on whether untrusted clients can write objects, so apps whose writes all go through trusted server code are less exposed. unknown whether other database backends are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116164","severity":null,"published_at":"2026-10-25T14:16:55+00:00","modified_at":"2026-10-25T14:16:55+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}