CVE-2026-116164— Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Quick assessment

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 8.6.100 之前的 Parse Server 版本，以及 9.0.0 至 9.10.4-alpha.3 之间的版本中，服务器未拒绝客户端在对象写入操作中使用的保留内部字段名称。这导致客户端能够存储或清除内部字段。攻击者可写入一个保留字段，致使 MongoDB 在读取该对象时失败，从而破坏该类对所有用户的查询操作；或者清除自身的账户锁定状态和密码历史记录，以绕过账户锁定策略和密码策略。

CVSS 6.3 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

Source: CVE Program / CVE List V5

Vulnerability Description

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
parse-community	parse-server	9.0.0 ~ 9.10.4-alpha.3	-
parse-community	parse-server	0 ~ 8.6.100	-

II. Public POCs for CVE-2026-116164

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116164

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116164 (2)

https://www.cve.org/CVERecord?id=CVE-2026-116164

Same Patch Batch · parse-community · 2026-10-25 · 5 CVEs total

CVE-2026-116165	8.8 HIGH	Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
CVE-2026-116163	7.4 HIGH	Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
CVE-2026-116161	6.0 MEDIUM	Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscrip
CVE-2026-116162	2.1 LOW	Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

IV. Related Vulnerabilities

Same product: parse-server

Same vendor: parse-community

Same weakness: CWE-20