CVE-2026-100631

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.90 Parse Server versions 9.0.0 through 9.10.1-alpha.8

Description The device token deduplication logic for installation records fails to validate the type of client-supplied installation fields before using them to construct database queries. An unauthenticated remote attacker with knowledge of the public application ID can submit non-string values in these fields to inject query operators. This causes the deduplication cleanup process, which operates with elevated privileges before class-level permissions are checked, to delete all device registrations in the application or a specific subset chosen by the attacker. This action results in the permanent loss of registrations on the server, preventing the delivery of push notifications until all clients re-register. Any deployment using push notifications that exposes the REST API to clients is affected in its default configuration.

Recommendations Update to version 8.6.90 or later. Update to version 9.10.1-alpha.9 or later.