Field Validation Flaw in Parse Server Affects MongoDB Implementation
CVE-2026-121415

6.3MEDIUM

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121415?

Prior to version 8.6.111 and certain 9.0.0 releases, Parse Server on MongoDB lacks proper validation for null-valued dot notation keys. This oversight enables any user with write access, including those without authentication where public write permissions are granted, to manipulate and corrupt data fields. Consequently, users may encounter objects that are unreadable due to modified internal date fields or experience failures in atomic operations tied to number fields.

Affected Version(s)

parse-server 9.0.0 < 9.10.6-alpha.3

parse-server 0 < 8.6.111

parse-server 9.10.6-alpha.3

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://github.com/parse-community/parse-server/pull/10804
patchissue-tracking
https://github.com/parse-community/parse-server/pull/10805
patchissue-tracking

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.