CVE-2026-31901
User Enumeration in Parse Server Email Verification Endpoint
Publication date: 2026-03-11
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | From 9.0.0 (inc) to 9.6.0 (exc) |
| parseplatform | parse-server | to 8.6.34 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-204 | The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "This vulnerability is a user enumeration issue in Parse Server's email verification endpoint (/verificationEmailRequest). Before the fix, the endpoint returned different error responses depending on whether an email address was registered, already verified, or did not exist. An attacker could exploit this behavior by sending requests with various email addresses and analyzing the distinct error messages to determine which email addresses were registered in the application."}] [2]
How can this vulnerability impact me? :
The vulnerability allows an attacker to discover which email addresses are registered users of the application by observing different error responses from the email verification endpoint. This information disclosure can lead to targeted attacks such as phishing, social engineering, or brute force attempts against known user accounts. Although it does not directly compromise user data or system integrity, it exposes sensitive information about user existence.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by observing the behavior of the email verification endpoint (/verificationEmailRequest) on your Parse Server deployment when email verification is enabled (verifyUserEmails: true). Specifically, sending requests with different email addresses and analyzing the distinct error responses can reveal whether an email address is registered, already verified, or does not exist.'}, {'type': 'paragraph', 'content': 'To detect this on your system, you can use command-line tools like curl to send POST requests to the /verificationEmailRequest endpoint with various email addresses and observe the responses.'}, {'type': 'list_item', 'content': 'curl -X POST https://your-parse-server-domain/verificationEmailRequest -d \'{"email":"[email protected]"}\' -H \'Content-Type: application/json\''}, {'type': 'paragraph', 'content': 'By comparing the response messages or HTTP status codes for different email addresses, you can determine if the server is leaking information about user existence, indicating the presence of the vulnerability.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this vulnerability immediately, you should upgrade your Parse Server deployment to a patched version where the issue is fixed. The fixed versions are 8.6.34 and 9.6.0-alpha.8.'}, {'type': 'paragraph', 'content': "The fix involves changing the behavior of the email verification endpoint to return a generic success response for all verification email requests regardless of the email's validity or verification status, preventing user enumeration."}, {'type': 'paragraph', 'content': 'Additionally, ensure that the Parse Server configuration option emailVerifySuccessOnInvalidEmail is enabled (default: true) to enforce this mitigation.'}, {'type': 'paragraph', 'content': 'No known workarounds exist other than upgrading and applying the configuration changes.'}] [1, 2, 3]