Medium severity · published Oct 25, 2026
CVE-2026-116164
Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
New
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parse-server · parse-community
9.0.0 before 9.10.4-alpha.3; before 8.6.100 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116164
github.com
https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr
www.vulncheck.com
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.3-reserved-field-name-injection-via-object-writes
More from parse-server
10.0
CVE-2026-30966
Parse Server role escalation and CLP bypass via direct `_Join` table write
9.8
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
9.8
CVE-2026-31871
Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
9.8
CVE-2026-31856
Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
9.8
CVE-2026-31840
Parse Server has a SQL injection via dot-notation field name in PostgreSQL