Vulnerability Description
Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.
Related Weaknesses (CWE)
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q2
- https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.3-re
FAQ
What is CVE-2026-116164?
CVE-2026-116164 is a documented vulnerability. Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can wri...
How severe is CVE-2026-116164?
CVSS scoring is not yet available for CVE-2026-116164. Check NVD for updates.
Is there a patch for CVE-2026-116164?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.