CVE-2026-116164

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Published Oct 25, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

Analysis

Technical impact

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 allows clients to write reserved internal field names, enabling storage or clearing of fields that the system considers internal. This flaw can make object reads fail in MongoDB, disrupting queries for all users, or permit a user to clear their account lockout state and password history, effectively bypassing lockout and password policies. The vulnerability is a classic example of improper input validation.

Affected Systems

The affected systems are Parse Server from parse-community, all versions prior to 8.6.100 and from 9.0.0 up to but not including 9.10.4-alpha.3. Users running these releases should review version and apply the fix.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation at present. Attackers can exploit the flaw remotely through the application’s client API; authenticated clients can inject reserved field names, so the risk is higher for systems that expose writable endpoints without proper validation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

parse-community

parse-server

unaffected

Version	Status	Constraints
`9.0.0`	affected	< 9.10.4-alpha.3
`9.10.4-alpha.3`	unaffected	—

parse-community

parse-server

unaffected

Version	Status	Constraints
`0`	affected	< 8.6.100
`8.6.100`	unaffected	—

No data.

Vendor Product Versions

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[9.0.0,9.10.4-alpha.3)`	affected	semver	—
`9.10.4-alpha.3`	unaffected	semver	—

Parse Community

Parse Server

Version	Status	Scheme	Platform
`[0,8.6.100)`	affected	generic	—
`8.6.100`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Parse Server to version 9.10.4-alpha.3 or newer, or to 8.6.100 or later.
Implement server‑side validation that rejects any writes containing reserved internal field names if an upgrade is not immediately possible.
Review and restrict exposed write operations in the Parse Server application to prevent unauthorized clients from modifying internal fields.

Generated by OpenCVE AI on October 25, 2026 at 16:43 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.344% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.3-reserved-field-name-injection-via-object-writes

History

Nov 4, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Parse Community Parse Community parse Server
Vendors & Products		Parse Community Parse Community parse Server

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.
Title		Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
First Time appeared		Parseplatform Parseplatform parse-server
Weaknesses		CWE-20
CPEs		cpe:2.3:a:parseplatform:parse-server::::::::
Vendors & Products		Parseplatform Parseplatform parse-server
References		https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.3-reserved-field-name-injection-via-object-writes
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`