BIT-parse-2026-116164

    Dashboard / Vulnerabilities / BIT-parse-2026-116164

    BIT-parse-2026-116164

    Published: 30 Oct 2026Last Modified: 30 Oct 2026

    Summary: Parse Server 9.0.0 before 9.10.4 Reserved Field Name Injection via Object Writes

    Details: Parse Server before 8.6.100 and 9.0.0 before 9.10.4 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

    References: https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr, https://nvd.nist.gov/vuln/detail/CVE-2026-116164, https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.3-reserved-field-name-injection-via-object-writes

    Affected packages

    Package

    Name: parse

    Purl: pkg:bitnami/parse

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -8.6.100

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-parse-2026-116164 | CVE-DB