BIT-parse-2026-116164

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2026-116164.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-parse-2026-116164
Aliases
Published
2026-10-30T15:35:45Z
Modified
2026-10-30T20:56:19Z
Summary
Parse Server 9.0.0 before 9.10.4 Reserved Field Name Injection via Object Writes
Details

Parse Server before 8.6.100 and 9.0.0 before 9.10.4 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / parse

Package

Name
parse
Purl
pkg:bitnami/parse

Severity

  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.6.100
Introduced
9.0.0
Fixed
9.10.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/parse/BIT-parse-2026-116164.json"