CVE-2026-112768 Overview
CVE-2026-112768 is an authorization flaw in Parse Server, an open-source backend framework used to build mobile and web application APIs. Versions before 8.6.99 and the 9.0.0 through 9.10.3-alpha.2 branch evaluate validation checks against the target account during a user update before authorizing the caller. The server then reflects the outcome in the response. An unauthenticated attacker can abuse this behavior to enumerate usernames, email addresses, and in some configurations guess current or previous passwords. The weakness maps to [CWE-863: Incorrect Authorization].
Critical Impact
Unauthenticated attackers can enumerate accounts and bypass lockout protections to validate guessed credentials against production Parse Server deployments.
Affected Products
- Parse Server versions before 8.6.99
- Parse Server 9.0.0 before 9.10.3-alpha.2
- Applications deployed on vulnerable Parse Server builds
Discovery Timeline
- 2026-10-19 - CVE-2026-112768 published to the National Vulnerability Database (NVD)
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-112768
Vulnerability Analysis
Parse Server exposes a REST and GraphQL API for updating _User objects. During an update request, the server executes validation routines against the target account before confirming that the caller holds a valid session for that account. Checks include uniqueness validation on username and email, and password history comparison when passwordPolicy.maxPasswordHistory or passwordPolicy.doNotAllowUsername is configured.
The server reflects distinct error states back to the caller. A unique-constraint failure signals that a username or email is already registered. A password-history failure signals that a candidate value matches a current or previous credential. Because these checks run before authorization, the response differentiates between "account state blocked the update" and "caller is not authorized", producing an oracle usable without any session token.
Root Cause
The root cause is the ordering of operations in the user update handler. Authorization decisions occur after state-dependent validation runs against the target record. This violates the principle that authorization must gate any logic that observes protected data. Account lockout controls that normally throttle credential guessing never trigger because the probing request never reaches the authentication path.
Attack Vector
An attacker sends crafted update requests to the /parse/users/<objectId> endpoint over the network. By varying the username, email, or password field and observing response codes and messages, the attacker confirms whether a value exists or matches policy constraints. The attack requires no privileges and no user interaction. When maxPasswordHistory is enabled, each probe silently validates a password guess against the full history for the targeted account.
See the GitHub Security Advisory GHSA-p49q-9w65-f9p7 and the VulnCheck Advisory on Parse Server for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-112768
Indicators of Compromise
- High volumes of PUT or POST requests to /parse/users/<objectId> endpoints from a single source without a valid X-Parse-Session-Token header
- Repeated 4xx responses referencing Account already exists, username taken, or password-policy error codes
- Spikes in failed updates targeting varying objectId values from the same client IP or user agent
Detection Strategies
- Instrument Parse Server logs to record request method, path, caller identity, and error class for every _User mutation
- Alert on unauthenticated user-update attempts that generate uniqueness or password-history errors above a baseline threshold
- Correlate repeated enumeration-style errors with downstream authentication attempts from the same source
Monitoring Recommendations
- Forward Parse Server access logs and application telemetry to a centralized analytics pipeline for retention and query
- Monitor for distributed probing patterns across proxy or CDN front ends that may obscure single-source rate anomalies
- Track changes to passwordPolicy.maxPasswordHistory and doNotAllowUsername settings, which expand the oracle surface
How to Mitigate CVE-2026-112768
Immediate Actions Required
- Upgrade Parse Server to version 8.6.99 or 9.10.3-alpha.2 or later as published by the maintainers
- Audit application logs for prior unauthenticated update traffic targeting the _User class
- Rotate credentials for any accounts that show evidence of successful password-history probing
Patch Information
The Parse Server maintainers released fixed builds in versions 8.6.99 and 9.10.3-alpha.2. The fix reorders the update pipeline so that caller authorization executes before any validation against the target account. Review the GitHub Security Advisory GHSA-p49q-9w65-f9p7 for the complete patch notes and upgrade instructions.
Workarounds
- Place Parse Server behind a web application firewall rule that blocks unauthenticated requests to /parse/users/<objectId> update endpoints
- Temporarily disable passwordPolicy.maxPasswordHistory and passwordPolicy.doNotAllowUsername until patching to remove the password-oracle condition
- Apply strict per-IP rate limits on user-update endpoints to slow enumeration attempts
# Configuration example: upgrade and restart Parse Server
npm install parse-server@8.6.99 --save
# or for the 9.x branch
npm install parse-server@9.10.3-alpha.2 --save
pm2 restart parse-server
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
