Medium severityNVD Advisory· Published Oct 19, 2026· Updated Oct 19, 2026

CVE-2026-112768

Description

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Parse Community/Parse Serverllm-fuzzy
Range: <8.6.99, <9.10.3-alpha.2

Patches

Vulnerability mechanics

References

github.com/parse-community/parse-server/security/advisories/GHSA-p49q-9w65-f9p7nvd
www.vulncheck.com/advisories/parse-server-before-8.6.99-and-9-x-before-9.10.3-alpha.2-information-disclosure-via-user-updatenvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000