CVE-2026-112768: Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.99
Event History
Frequently Asked Questions
Which Parse Server releases are affected?
Affected releases are Parse Server versions before 8.6.99 and versions from 9.0.0 before 9.10.3-alpha.2.
Does exploitation require an authenticated user or a valid session?
No. An unauthorized caller can exploit the response behavior with or without a session.
What information can an attacker confirm?
An attacker can use guessed values to confirm usernames or email addresses. If passwordPolicy.maxPasswordHistory or doNotAllowUsername is configured, they can also confirm guessed current or previous passwords.
Does account lockout prevent this issue?
No. The disclosed behavior allows the attacker to bypass account lockout while confirming guesses.