CVE-2026-112768
Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
| CWE | CWE-863 |
| Vendor | parse-community |
| Product | parse-server |
| Published | Oct 19, 2026 |
| Last Updated | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for parse-community parse-server
Be the first to know when new unknown vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
parse-community / parse-server
9.0.0 < 9.10.3-alpha.2
parse-community / parse-server
0 < 8.6.99
References
Credits
mtrezza