CVE-2026-112768: Incorrect Authorization in parse-community parse-server

CVE-2026-112768 is an incorrect authorization vulnerability in parse-community's parse-server. In affected versions, the server performs checks against the target account during a user update operation before properly authorizing the caller. The results of these checks are reflected in the response, enabling an unauthorized attacker, regardless of session status, to confirm guessed usernames or emails. Additionally, if passwordPolicy.maxPasswordHistory or doNotAllowUsername settings are enabled, the attacker can confirm guessed current or previous passwords, effectively bypassing account lockout protections.

An attacker without authorization can enumerate valid usernames or emails and, depending on password policy configurations, verify guessed passwords. This information disclosure can facilitate further attacks such as credential stuffing or targeted password guessing. The vulnerability bypasses account lockout protections, increasing the risk of successful unauthorized access attempts.

A fix is available in parse-server versions 8.6.99 and 9.10.3-alpha.2 and later. Users should upgrade to these or newer versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.