CVE-2026-100631: Parse Server Auth Bypass Vulnerability

CVE-2026-100631 Overview

Parse Server contains a NoSQL operator injection vulnerability in its device token deduplication logic for installation records. The flaw affects versions prior to 8.6.90 and versions from 9.0.0 prior to 9.10.1-alpha.9. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in installation fields to inject query operators. The deduplication cleanup runs with elevated privileges before class-level permissions are evaluated, allowing an attacker to delete every device registration in the application. Push notifications cannot be delivered until every client re-registers, since deleted records cannot be recovered server-side.

Critical Impact
Unauthenticated attackers can wipe all push notification device registrations in affected Parse Server deployments using only the public application ID.

Affected Products

Parse Server versions prior to 8.6.90
Parse Server versions from 9.0.0 prior to 9.10.1-alpha.9
Any Parse Server deployment exposing the REST API with push notifications enabled (default configuration)

Discovery Timeline

2026-09-26 - CVE-2026-100631 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100631

Vulnerability Analysis

The vulnerability is classified as [CWE-943] Improper Neutralization of Special Elements in Data Query Logic. Parse Server's installation deduplication logic constructs database queries using client-supplied fields such as deviceToken without validating that the values are strings. When an attacker submits a JSON object instead of a string, the embedded keys are interpreted as MongoDB query operators. This transforms a scoped match query into an attacker-controlled filter that matches arbitrary records.

The deduplication cleanup is executed with elevated privileges before class-level permissions (CLPs) are enforced. This privilege ordering lets the manipulated query delete installation records that the caller would otherwise be unable to touch. No account, session token, master key, or user interaction is required to trigger the behavior.

Root Cause

The root cause is missing type validation on client-supplied installation fields before they are incorporated into the deduplication query. The server trusts that fields such as deviceToken are scalar strings and does not reject structured input. Compounding the issue, the cleanup path runs ahead of permission evaluation, so authorization controls cannot block the malicious query.

Attack Vector

The attack is delivered over the network against the Parse Server REST API. An attacker sends an installation registration request containing a non-string value, such as a JSON object with MongoDB operators like $ne or $exists, in a deduplication field. The server builds a database query from the injected operator and executes a deletion that matches every installation record for the application, or a subset chosen by the attacker. Only the public application ID is required, which is typically embedded in client applications and considered non-secret.

Technical details are documented in the GitHub Security Advisory GHSA-cc6h-c8m4-hgrx and the VulnCheck Advisory for Parse Server.

Detection Methods for CVE-2026-100631

Indicators of Compromise

Sudden mass deletion of records in the _Installation class with no corresponding administrative action.
POST or PUT requests to /parse/installations endpoints containing non-string values (JSON objects) in fields such as deviceToken, installationId, or deviceType.
Spikes in client re-registration traffic following unexplained push notification delivery failures.
Database audit logs showing deletion operations originating from unauthenticated REST API callers.

Detection Strategies

Inspect reverse proxy and application logs for installation API requests whose payload fields contain object literals rather than string tokens.
Alert on bulk delete operations against the _Installation collection performed outside of maintenance windows.
Correlate increases in client re-registration volume with the absence of a legitimate push notification campaign.

Monitoring Recommendations

Enable verbose request logging on the Parse Server REST API and forward it to a centralized analytics platform for query-shape analysis.
Monitor MongoDB operation logs for unexpected deleteMany operations against the installation collection.
Track push notification delivery success rates as a leading indicator of installation record loss.

How to Mitigate CVE-2026-100631

Immediate Actions Required

Upgrade Parse Server to version 8.6.90 or 9.10.1-alpha.9 or later without delay.
Restrict public exposure of the /parse/installations endpoint at the reverse proxy or API gateway until the upgrade is complete.
Back up the _Installation collection so that registration data can be restored if deletion has already occurred.
Review historical API logs for prior exploitation attempts involving non-string installation fields.

Patch Information

Parse Server versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. Patch details are published in the GitHub Security Advisory GHSA-cc6h-c8m4-hgrx.

Workarounds

No workaround other than upgrading is available per the vendor advisory.
Operators that cannot upgrade immediately should block or filter installation API requests whose JSON payloads contain object-typed values in deduplication fields using a web application firewall rule.

bash

# Upgrade Parse Server to a patched release
npm install parse-server@8.6.90
# or, for the 9.x branch
npm install parse-server@9.10.1-alpha.9