Parse Server versions prior to 8.6.99 and 9.10.3-alpha.2 evaluate account checks during a user update request before the caller is authorized and then expose the outcome in the response. An unauthenticated or merely authenticated caller can therefore discover whether a guessed username, email, or (when passwordPolicy.maxPasswordHistory or doNotAllowUsername is enabled) a guessed current or former password belongs to an account. The resulting data leak can be used to enumerate valid credentials and bypass account lockout mechanisms, posing a risk to confidentiality and account integrity.

The vulnerability affects parse-community's Parse Server. Any installation of Parse Server with a Node.js runtime that is older than version 8.6.99 or older than the 9.0.0 line before 9.10.3-alpha.2 is potentially exposed. No other vendors or product versions are listed as impacted.

The defined CVSS score of 6.9 indicates a medium severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, implying no publicly disclosed active exploit at the time of assessment. The likely attack vector is a crafted user update request, which may be sent by an attacker without authenticated credentials or with limited session privileges. Upon execution, the response reveals whether the target account exists and, in certain configuration scenarios, whether a guessed password is valid. The combination of identifier enumeration and password visibility can accelerate brute‑force attempts or facilitate social engineering.