CVE-2026-100631

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available.

• CWE-943

• https://github.com/parse-community/parse-server/security/advisories/GHSA-cc6h-c8m4-hgrx
• https://www.vulncheck.com/advisories/parse-server-9.0.0-unauthenticated-installation-deletion-via-operator-injection

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100626capgo through 12.128.2 contains an insecure direct object re…4.3
• CVE-2026-100627Capgo (Cap-go/capgo.app) server backend Supabase functions c…8.1
• CVE-2026-100628capgo.app before 12.128.12 fails to enforce an organization'…4.3
• CVE-2026-100629Capgo (capgo.app backend) before 12.127.5 contains an author…5.5
• CVE-2026-10063A vulnerability was identified in TRENDnet TEW-432BRP 3.10B2…9.8
• CVE-2026-100630AVideo contains a stored cross-site scripting vulnerability …5.4
• CVE-2026-100632Parse Server is an open-source backend server. In versions >…6.5
• CVE-2026-100633SiYuan is a self-hosted personal knowledge management system…6.5
• CVE-2026-100634SiYuan before v3.8.4 does not validate the sender or restric…4.7
• CVE-2026-100635SiYuan before v3.8.4 contains an authentication bypass vulne…5.9
• CVE-2026-100636SiYuan versions before v3.8.4 contain a path traversal vulne…7.6
• CVE-2026-100637SiYuan versions before v3.8.4 contain a path traversal vulne…7.6