---
id: "CVE-2026-126392"
page: "https://infrastack.ai/live/CVE-2026-126392"
kind: "vulnerability"
aliases: ["CVE-2026-126392"]
title: "Parse Server: write-only clients can probe which MongoDB fields exist"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mongodb", "node", "package", "parse-server"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-11-13T10:17:43+00:00"
first_seen_at: "2026-11-13T10:47:18+00:00"
updated_at: "2026-11-13T10:58:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126392", "first_seen_at": "2026-11-13T10:47:18+00:00"}]
exploit_sources: []
---

# Parse Server: write-only clients can probe which MongoDB fields exist

Link for people: https://infrastack.ai/live/CVE-2026-126392 (this .md is for agents)

Parse Server versions from 9.10.6-alpha.1 before 9.10.8-alpha.1 leak whether a field is stored in MongoDB. A client with write-only access can send dot-notation updates and infer field existence from whether the server returns an internal error or success.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Parse Server version with `npm ls parse-server` and compare it to the fixed range.
- Look for apps that accept client updates with dot-notation operations on top-level fields.

## Fix

- Parse Server: move to `9.10.8-alpha.1` or later.

## Timeline

- 2026-11-13T10:47:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126392

## Documents

- [advisory] Vendor advisory: github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-4m87-fqwv-2m8v
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.8-alpha.1-information-disclosure-via-dot-notation-update

## From the sources

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_