CVE-2026-116164
Received Received - Intake

Parse Server Internal Field Write Bypass Leading to DoS

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116164
EUVD
EUVD-2026-109425

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse-community parse-server 9.0.0
parse-community parse-server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 allows clients to write reserved internal field names in objects. This causes MongoDB reads to fail, disrupting queries for all users on that class. Attackers can also clear their own account lockout state and password history to bypass security policies.

Detection Guidance

To detect this vulnerability, check if your Parse Server version is below 8.6.100 or 9.0.0 to 9.10.3-alpha.2. Use commands like 'npm list parse-server' to verify the installed version. Monitor logs for failed object reads or unexpected field writes in MongoDB.

Impact Analysis

If exploited, this vulnerability can disrupt database queries for all users, leading to service outages or data unavailability. Attackers may bypass account lockout and password policies, gaining unauthorized access or maintaining persistence despite security controls.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's access controls. Disruptions in query functionality may also impact data availability, affecting compliance with availability requirements.

Mitigation Strategies

Upgrade Parse Server to version 8.6.100 or 9.10.4-alpha.3 or later. As a temporary workaround, register an empty beforeSave Cloud Code trigger for every writable class to discard reserved field names before saving.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart