CVE-2026-126392

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.10.6-alpha.1 through 9.10.7-alpha.1

Description An information disclosure issue allows clients with write access, but lacking read access, to determine if specific fields exist within MongoDB. This is achieved by sending update requests using dot notation on top-level fields and analyzing whether the server returns an internal error or a success response.

Recommendations Update Parse Server to version 9.10.8-alpha.1.