PT-2026-123005
CVE-2026-116164
·
Published
2026-10-25
·
Updated
2026-10-30
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Parse Server versions prior to 8.6.100
Parse Server versions 9.0.0 through 9.10.4-alpha.2
Description
Parse Server fails to reject reserved internal field names during client object writes, which allows clients to store or clear internal fields. This can be exploited to write a reserved field that causes MongoDB object reads to fail, disrupting queries for all users on that class. Additionally, attackers can clear their own password history and account lockout state to bypass password policies and lockout mechanisms.
Recommendations
Update Parse Server to version 8.6.100 or later.
Update Parse Server to version 9.10.4-alpha.3 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾