PT-2026-117619 · Unknown · Parse Server
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Parse Server versions prior to 8.6.99
Parse Server versions 9.0.0 through 9.10.3-alpha.1
Description
An issue exists where the server evaluates checks against a target account during a user update before authorizing the caller and reflects the results in the response. This allows an unauthorized caller, regardless of session status, to confirm guessed usernames or emails. Additionally, if
passwordPolicy.maxPasswordHistory or doNotAllowUsername is configured, the caller can confirm guessed current or previous passwords, which enables the bypass of account lockout mechanisms.Recommendations
Update Parse Server to version 8.6.99 or later.
Update Parse Server to version 9.10.3-alpha.2 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Parse Server