CVE-2026-100631

Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Published Sep 26, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available.

Analysis

Technical impact

Parse Server allows an attacker who only knows the public application ID to supply non-string values for installation fields, causing the server to inject query operators into the deduplication cleanup. The cleanup runs with elevated privileges before class‑level permissions are enforced, so the attacker can delete every device registration or a chosen subset. Deleted registrations cannot be recovered on the server, resulting in loss of push notification capability until clients re‑register. This defect is a data tampering, integrity, and availability issue that can be exploited without credentials.

Affected Systems

The vulnerability affects the open‑source Parse Server from the parse-community vendor, in all versions prior to 8.6.90 and in versions from 9.0.0 up to (but not including) 9.10.1‑alpha.9. Any deployment that exposes the REST API to clients and uses push notifications is impacted in its default configuration.

Risk and Exploitability

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is the publicly exposed REST API, where an unauthenticated attacker can send malicious payloads. Because no authentication or master key is required, the risk is high for any application that accepts external installation data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

parse-community

parse-server

unaffected

Version	Status	Constraints
`9.0.0`	affected	< 9.10.1-alpha.9
`9.10.1-alpha.9`	unaffected	—

parse-community

parse-server

unaffected

Version	Status	Constraints
`0`	affected	< 8.6.90
`8.6.90`	unaffected	—

No data.

Vendor Product Versions

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[9.0.0,9.10.1-alpha.9)`	affected	semver	—
`9.10.1-alpha.9`	unaffected	semver	—

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[0,8.6.90)`	affected	generic	—
`8.6.90`	unaffected	generic	—

Parseplatform

Parse-server

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Parse Server to version 8.6.90 or 9.10.1‑alpha.9 or later, which rejects non-string values and scopes the deduplication cleanup to the calling application.
Immediately restrict access to the Parse Server REST API by firewall or proxy to trusted IP ranges, preventing unauthenticated requests from external clients until the patch is applied.
Disable the push notification feature temporarily or drop the corresponding installation endpoint in your application layer to stop new device registrations until the vulnerability is patched.

Generated by OpenCVE AI on September 26, 2026 at 15:52 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.357% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/parse-community/parse-server/security/advisories/GHSA-cc6h-c8m4-hgrx
https://www.vulncheck.com/advisories/parse-server-9.0.0-unauthenticated-installation-deletion-via-operator-injection

History

Sep 28, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 26, 2026 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Parse Community Parse Community parse Server
Vendors & Products		Parse Community Parse Community parse Server

Sep 26, 2026 1:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available.
Title		Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection
First Time appeared		Parseplatform Parseplatform parse-server
Weaknesses		CWE-943
CPEs		cpe:2.3:a:parseplatform:parse-server::::::::
Vendors & Products		Parseplatform Parseplatform parse-server
References		https://github.com/parse-community/parse-server/security/advisories/GHSA-cc6h-c8m4-hgrx https://www.vulncheck.com/advisories/parse-server-9.0.0-unauthenticated-installation-deletion-via-operator-injection
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`