CVE-2026-126392

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe interna...

CVE-2026-126392 Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe interna...

CVE-2026-126392 Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe interna...

EUVD-2026-125173

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe interna...

CVE-2026-126392

Parse Server versions 9.10.6-alpha.1 before 9.10.8-alpha.1 are vulnerable to an information disclosure vulnerability. The issue occurs because clients with write access (but no read access) can use dot notation operations on top-level fields during updates. By observing whether the server returns...

PT-2026-146678

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe interna...

CVE-2026-121965 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clien...

CVE-2026-121965 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clien...

CVE-2026-121965

The Parse Server software versions before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 are vulnerable to a prototype pollution vulnerability (CWE-1321). This occurs when the server builds objects for Cloud Code triggers and LiveQuery using a dot notation key where an intermediate segment resolves thro...

CVE-2026-121415

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

CVE-2026-121414

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

CVE-2026-121415

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

CVE-2026-121415

Parse Server versions before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 using MongoDB are vulnerable to field corruption. The root cause is that the server skips field type validation for null-valued dot notation keys , which allows an attacker to write sub-documents beneath existing Pointer, Number...

CVE-2026-121415 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

CVE-2026-121414 Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

EUVD-2026-115947

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

EUVD-2026-115946

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writab...

CVE-2026-121415 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

CVE-2026-121415 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

PT-2026-136172

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...