CVE-2026-112768 in Parse Server
Summary
by MITRE • 10/19/2026
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The identified vulnerability represents a critical authentication logic flaw within Parse Server versions prior to 8.6.99 and the 9.0.0 series before version 9.10.3-alpha.2. This security issue stems from an incorrect ordering of operations during user account updates, specifically where validation checks against target accounts are executed before verifying the authorization status of the caller initiating the request. In a properly secured system, access control decisions must precede any sensitive data processing or state modification to ensure that unauthenticated or unauthorized entities cannot interact with protected resources. By reversing this sequence, the application inadvertently exposes internal validation logic and error responses to attackers who lack valid credentials or session tokens.
This architectural flaw enables several distinct attack vectors primarily centered around information disclosure and authentication bypass. An attacker can perform username enumeration by sending update requests for various potential usernames without possessing a valid session. The server processes these requests against the target accounts, evaluates constraints such as uniqueness requirements, and reflects the outcome in the HTTP response. If a specific username already exists or violates certain policies, the error message returned will differ from that of a non-existent user, allowing an attacker to confirm the existence of valid account identifiers with high precision. This capability significantly aids reconnaissance efforts by mapping out the active user base without triggering standard login rate limits associated with authentication endpoints.
Furthermore, when specific configuration options such as passwordPolicy.maxPasswordHistory or doNotAllowUsername are enabled, the vulnerability escalates in severity. These settings enforce policies that prevent users from reusing previous passwords or selecting usernames identical to their current ones. Due to the pre-authorization evaluation flaw, an attacker can guess these historical credentials by observing response variations when attempting updates with guessed values. This effectively allows for password history enumeration, providing attackers with additional data points to facilitate credential stuffing attacks or social engineering efforts. The ability to retrieve this information without authentication undermines the intended security posture of password rotation policies designed to mitigate long-term credential compromise risks.
The operational impact extends beyond mere information leakage as it directly facilitates account lockout bypassing mechanisms. Typically, systems implement account lockouts after a certain number of failed login attempts to prevent brute-force attacks. However, because this vulnerability allows an attacker to probe for valid usernames and passwords through update endpoints rather than standard authentication flows, the traditional lockout counters are not triggered or applied correctly. An adversary can systematically iterate through potential credentials using these update requests, effectively conducting offline-style guessing attacks against live accounts while remaining undetected by standard brute-force protection mechanisms. This undermines the integrity of account security controls and increases the likelihood of successful unauthorized access to user data.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to enforce proper authorization checks before processing sensitive operations. It also relates closely to CWE-209 Generation of Error Message Containing Sensitive Information, given that the response payloads reveal details about account existence and policy violations to unauthorized parties. In terms of MITRE ATT&CK framework mapping, this behavior supports techniques such as T1589.001 Gather Victim Identity Information - Credentials, where attackers collect valid usernames for subsequent attacks, and potentially T1110 Brute Force if the enumeration is leveraged to feed credential stuffing campaigns. The lack of proper access control verification prior to data exposure creates a foundational weakness that compromises multiple layers of defense-in-depth strategies employed by modern web applications.
Mitigation requires immediate upgrading to Parse Server version 8.6.99 or later, and for the 9.x branch, updating to at least version 9.10.3-alpha.2 where this logic error has been corrected. The fix ensures that authorization checks are performed before any validation against target account policies occurs, thereby preventing unauthorized callers from receiving informative responses about user existence or password history constraints. In addition to patching, organizations should implement strict input validation and rate limiting on all API endpoints, including those handling user updates, to further reduce the risk of enumeration attacks. Security monitoring solutions should be configured to detect unusual patterns in update request frequencies directed at non-existent users, which may indicate active exploitation attempts even after patches are applied. Regular security audits focusing on authorization logic ordering across all application entry points will help prevent similar architectural flaws from being introduced in future development cycles.