CVE-2026-126392: Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update
Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.8-alpha.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A client must have write access but not read access to the affected data. The attacker also needs to be able to submit updates using dot-notation operations on top-level fields.
What information can be disclosed?
An attacker can infer whether fields are stored in MongoDB. They do this by distinguishing internal server error responses from successful update responses.
Are all Parse Server versions affected?
The affected range is Parse Server 9.10.6-alpha.1 through versions before 9.10.8-alpha.1. Version 9.10.8-alpha.1 is not included in the stated affected range.