BIT-PARSE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when...