Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Low 3.7

In plain English

A low-severity improper input validation in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	9.0.0 – before 9.10.6-alpha.3
parse-community	parse-server	0 – before 8.6.111

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-655c-2xf3-77x9) vendor-advisory
https://github.com/parse-community/parse-server/pull/10804 patch, issue-tracking
https://github.com/parse-community/parse-server/pull/10805 patch, issue-tracking
VulnCheck Advisory: Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key third-party-advisory