medium6.9
CVE-2026-112768
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and …
Impact
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
Affected products
| Product | Affected versions |
|---|---|
| Parse Server | before 8.6.99 |
| 9.0.0 | before 9.10.3-alpha.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.