In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does… (CVE-2026-100631)
Parse Server versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9 contain a vulnerability in the device token deduplication logic. This logic fails to validate the type of client-supplied installation fields before using them in database queries. An unauthenticated attacker knowing only the public application ID can inject query operators to cause deletion of device registrations. This deletion disrupts push notifications until clients re-register. The issue is fixed in versions 8.6.90 and 9.10.1-alpha.9 by rejecting non-string values and scoping cleanup to the calling application. No workaround other than upgrading is available.
AI Analysis
Technical Summary
Parse Server's device token deduplication logic for installation records in versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9 does not validate the type of client-supplied installation fields before constructing database queries. This allows an unauthenticated remote attacker, knowing only the public application ID, to submit non-string values that inject query operators. Because the deduplication cleanup runs with elevated privileges before class-level permissions are checked, this can delete all or a subset of device registrations in the application. Deleted registrations are irrecoverable on the server, preventing push notifications until clients re-register. The vulnerability is addressed in versions 8.6.90 and 9.10.1-alpha.9 by rejecting non-string values with client errors and scoping deduplication cleanup to the calling application.
Potential Impact
An unauthenticated attacker can delete device registration records by injecting query operators via non-string installation fields. This causes denial of push notification service for all or selected clients until they re-register. No credentials or user interaction are required. The deletion is irreversible on the server side, impacting availability of push notifications.
Mitigation Recommendations
Upgrade to Parse Server version 8.6.90 or later, or 9.10.1-alpha.9 or later. These versions fix the vulnerability by rejecting non-string installation field values and scoping deduplication cleanup to the calling application. No other workaround is available.
In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does… (CVE-2026-100631)
Description
Parse Server versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9 contain a vulnerability in the device token deduplication logic. This logic fails to validate the type of client-supplied installation fields before using them in database queries. An unauthenticated attacker knowing only the public application ID can inject query operators to cause deletion of device registrations. This deletion disrupts push notifications until clients re-register. The issue is fixed in versions 8.6.90 and 9.10.1-alpha.9 by rejecting non-string values and scoping cleanup to the calling application. No workaround other than upgrading is available.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Parse Server's device token deduplication logic for installation records in versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9 does not validate the type of client-supplied installation fields before constructing database queries. This allows an unauthenticated remote attacker, knowing only the public application ID, to submit non-string values that inject query operators. Because the deduplication cleanup runs with elevated privileges before class-level permissions are checked, this can delete all or a subset of device registrations in the application. Deleted registrations are irrecoverable on the server, preventing push notifications until clients re-register. The vulnerability is addressed in versions 8.6.90 and 9.10.1-alpha.9 by rejecting non-string values with client errors and scoping deduplication cleanup to the calling application.
Potential Impact
An unauthenticated attacker can delete device registration records by injecting query operators via non-string installation fields. This causes denial of push notification service for all or selected clients until they re-register. No credentials or user interaction are required. The deletion is irreversible on the server side, impacting availability of push notifications.
Mitigation Recommendations
Upgrade to Parse Server version 8.6.90 or later, or 9.10.1-alpha.9 or later. These versions fix the vulnerability by rejecting non-string installation field values and scoping deduplication cleanup to the calling application. No other workaround is available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fq69-3pm5-2h3g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100631"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab89be6f7a7c541069420e4
Added to database: 09/27/2026, 04:30:30 UTC
Last enriched: 09/27/2026, 04:32:45 UTC
Last updated: 09/27/2026, 04:32:45 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.