{"id":"CVE-2026-126392","kind":"vulnerability","aliases":["CVE-2026-126392"],"related":[],"title":"Parse Server: write-only clients can probe which MongoDB fields exist","description":"Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.","summary":"Parse Server versions from 9.10.6-alpha.1 before 9.10.8-alpha.1 leak whether a field is stored in MongoDB. A client with write-only access can send dot-notation updates and infer field existence from whether the server returns an internal error or success.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mongodb","node","package","parse-server"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` and compare it to the fixed range.\n- Look for apps that accept client updates with dot-notation operations on top-level fields.","fix":"- Parse Server: move to `9.10.8-alpha.1` or later.","status":"open","published_at":"2026-11-13T10:17:43+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","triaged_at":"2026-11-13T10:58:59+00:00","updated_at":"2026-11-13T10:58:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:58:59Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server: move to `9.10.8-alpha.1` or later.","reach":"internet","title":"Parse Server: write-only clients can probe which MongoDB fields exist","impact":"low","summary":"Parse Server versions from 9.10.6-alpha.1 before 9.10.8-alpha.1 leak whether a field is stored in MongoDB. A client with write-only access can send dot-notation updates and infer field existence from whether the server returns an internal error or success.","audience":"developers","category":"package","nicknames":[],"who_cares":["parse-server","node","mongodb"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker learns which fields exist in the MongoDB schema.","analyst_note":"","how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` and compare it to the fixed range.\n- Look for apps that accept client updates with dot-notation operations on top-level fields.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Applications running Parse Server in the affected range that let clients with write but not read access send updates. The exposure is limited to learning field existence, not reading values. Deployments on other versions, or with no client write access, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000714,"input_tokens":4619,"output_tokens":504,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126392':15A,18A '-2026':14A,17A '9.10.6':29B,72C '9.10.8':32B,75C 'access':48B,90C 'allow':83C 'alpha.1':30B,33B,73C,76C 'attack':99C 'client':6A,43B,84C 'contain':77C 'cve':13A,16A 'disclosur':80C 'dot':52B,104C 'dot-not':51B 'error':66B,116C 'exist':12A,58B,123C 'field':11A,37B,57B,94C,111C,122C 'infer':56B,121C 'inform':79C 'intern':65B,114C 'leak':34B 'learn':92C 'level':110C 'mongodb':10A,19B,41B,98C 'node':20B 'notat':53B,105C 'observ':113C 'oper':106C 'packag':21B 'pars':1A,23B,25B,69C 'parse-serv':22B 'probe':8A 'read':89C 'respons':119C 'return':63B 'send':50B,101C 'server':2A,24B,26B,62B,70C,115C 'store':39B,96C 'success':68B,118C 'top':109C 'top-level':108C 'updat':54B,102C 'version':27B 'versus':117C 'vulner':81C 'whether':35B,60B,93C 'write':4A,46B,86C 'write-on':3A,45B","nicknames":[],"mitigations":[],"who_affected":"Applications running Parse Server in the affected range that let clients with write but not read access send updates. The exposure is limited to learning field existence, not reading values. Deployments on other versions, or with no client write access, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","mongodb","node","package","parseserver"],"campaign_type":null,"search_a":"'-126392':15A,18A '-2026':14A,17A 'client':6A 'cve':13A,16A 'exist':12A 'field':11A 'mongodb':10A 'pars':1A 'probe':8A 'server':2A 'write':4A 'write-on':3A","search_b":"'9.10.6':29B '9.10.8':32B 'access':48B 'alpha.1':30B,33B 'client':43B 'dot':52B 'dot-not':51B 'error':66B 'exist':58B 'field':37B,57B 'infer':56B 'intern':65B 'leak':34B 'mongodb':19B,41B 'node':20B 'notat':53B 'packag':21B 'pars':23B,25B 'parse-serv':22B 'return':63B 'send':50B 'server':24B,26B,62B 'store':39B 'success':68B 'updat':54B 'version':27B 'whether':35B,60B 'write':46B 'write-on':45B","search_c":"'9.10.6':72C '9.10.8':75C 'access':90C 'allow':83C 'alpha.1':73C,76C 'attack':99C 'client':84C 'contain':77C 'disclosur':80C 'dot':104C 'error':116C 'exist':123C 'field':94C,111C,122C 'infer':121C 'inform':79C 'intern':114C 'learn':92C 'level':110C 'mongodb':98C 'notat':105C 'observ':113C 'oper':106C 'pars':69C 'read':89C 'respons':119C 'send':101C 'server':70C,115C 'store':96C 'success':118C 'top':109C 'top-level':108C 'updat':102C 'versus':117C 'vulner':81C 'whether':93C 'write':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T14:01:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126392","severity":null,"published_at":"2026-11-13T10:17:43+00:00","modified_at":"2026-11-13T10:17:43+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","fetched_at":"2026-11-13T10:47:18+00:00","note":null}],"documents":[{"id":145026,"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-4m87-fqwv-2m8v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T14:01:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145027,"url":"https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.8-alpha.1-information-disclosure-via-dot-notation-update","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}