CVE-2026-116164

UNKNOWN 0.0

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

CWE	CWE-20
Vendor	parse-community
Product	parse-server
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for parse-community parse-server

Be the first to know when new unknown vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

parse-community / parse-server

9.0.0 < 9.10.4-alpha.3

parse-community / parse-server

0 < 8.6.100

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr vulncheck.com: https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.3-reserved-field-name-injection-via-object-writes

Credits

mtrezza