CVE-2026-116164

— UNSCOREDpublic exploit available

Published 2026-10-25 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

Weaknesses

CWE-20

Public exploit & PoC references

https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr

All references

https://github.com/parse-community/parse-server/security/advisories/GHSA-gwrq-q25v-g8mr
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.4-alpha.3-reserved-field-name-injection-via-object-writes

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2020-37289PoC
UNSCOREDCVE-2023-5649
MEDIUMCVE-2024-6423
MEDIUMCVE-2025-31980
MEDIUMCVE-2025-32000
CRITICALCVE-2025-71383
HIGHCVE-2026-100113
HIGHCVE-2026-100117

Related by shared AI tags and CWE weakness class. Browse the full archive.