CVE-2026-112769

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.98 Parse Server versions 9.0.0 through 9.10.3-alpha.1

Description Insufficient enforcement of class-level permissions for the Session class occurs during session creation. An authenticated user or an entity possessing a valid session token can bypass create and addField permissions by sending POST requests to the '/sessions' or '/classes/ Session' endpoints. This allows the creation of additional sessions for the user and the addition of fields to the Session class. These unauthorized sessions remain active even after the original session is logged out.

Recommendations Update Parse Server to version 8.6.98 or later. Update Parse Server to version 9.10.3-alpha.1 or later.