CVE-2026-116164: Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Q: Which Parse Server release lines require remediation?

Deployments running versions before 8.6.100 are affected. In the 9.x line, versions from 9.0.0 through before 9.10.4-alpha.3 are affected.

Q: What access would an attacker need to exploit this issue?

The attacker needs the ability to submit client object writes. They can use those writes to set or clear reserved internal fields that should not be client-controlled.

Q: What are the practical security impacts?

An attacker can write a reserved field that causes MongoDB reads of an object to fail, disrupting queries for all users of the affected class. They can also clear their own account lockout state and password history, bypassing lockout and password policies.

Published Oct 25, 2026

Updated

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

Affected Software

1 affected component

Parse Platform Parse Server<8.6.100, >=9.0.0<9.10.4-alpha.3

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionWeakness

Frequently Asked Questions

Which Parse Server release lines require remediation?

Deployments running versions before 8.6.100 are affected. In the 9.x line, versions from 9.0.0 through before 9.10.4-alpha.3 are affected.

What access would an attacker need to exploit this issue?

The attacker needs the ability to submit client object writes. They can use those writes to set or clear reserved internal fields that should not be client-controlled.

What are the practical security impacts?

An attacker can write a reserved field that causes MongoDB reads of an object to fail, disrupting queries for all users of the affected class. They can also clear their own account lockout state and password history, bypassing lockout and password policies.

CVE-2026-116164: Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Affected Software

Event History

Frequently Asked Questions

Which Parse Server release lines require remediation?

What access would an attacker need to exploit this issue?

What are the practical security impacts?

Company

Resources

Contact

Frequently Asked Questions

Which Parse Server release lines require remediation?

What access would an attacker need to exploit this issue?

What are the practical security impacts?