CVE-2026-100631
Received Received - Intake

Device Token Injection in Parse Server

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100631
EUVD
EUVD-2026-87725

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
parse_server parse_server to 9.10.1-alpha.9 (exc)
parse_community parse_server to 9.10.1-alpha.9 (exc)
parse_community parse_server 8.6.89
parse_community parse_server 9.10.1-alpha.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server, an open-source backend server. It allows unauthenticated attackers to delete all device installation records in a Parse Server application by injecting query operators into device token deduplication fields. The attack requires only the public application ID and no authentication or user interaction. The issue stems from improper neutralization of special elements in query logic, enabling manipulation of deduplication queries.

Detection Guidance

To detect this vulnerability, check if your Parse Server version is within the affected range (prior to 8.6.90 or 9.0.0 to 9.10.1-alpha.8). Review server logs for unusual deletion events in device installation records. Monitor for push notification failures across all clients.

Impact Analysis

This vulnerability can disrupt push notifications by deleting device registration records. Since deleted registrations cannot be recovered, push notifications cannot be delivered until every client re-registers. Any deployment exposing the REST API with push notifications enabled is affected in its default configuration.

Mitigation Strategies

Immediately upgrade to a patched version: 8.6.90 or later, or 9.10.1-alpha.9 or later. Ensure no REST API is exposed to untrusted clients. Verify push notification functionality after upgrade. No other mitigation is effective.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100631. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart