CVE-2026-112769 parse-community CVE debrief

Who should care

Defenders responsible for Parse Server deployments, especially those using versions before 8.6.98 and 9.10.3-alpha.1, should assess exposure and verify inventory. They should review and update affected versions to 8.6.98 or 9.10.3-alpha.1 and monitor for potential session creation and _Session class modifications.

Why it matters

CVE-2026-112769 is a low-severity vulnerability affecting Parse Server, allowing authenticated users to create additional sessions and add fields to the _Session class. Defenders should verify inventory, assess exposure, and update affected versions.

• Potential unauthorized session creation
• Possible modifications to _Session class
• Verification of affected versions required
• Inventory assessment and update necessary

Technical summary

Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 does not enforce create and addField class-level permissions of the _Session class when creating sessions. An authenticated user can send POST requests to /sessions or /classes/_Session to create additional sessions and add fields to _Session. This vulnerability allows for potential unauthorized session creation and possible modifications to the _Session class. Defenders should verify inventory and assess exposure of Parse Server deployments, especially for versions before 8.6.98 and 9.10.3-alpha.1.

Defensive priority

Defenders should prioritize verifying inventory and assessing exposure of Parse Server deployments, especially for versions before 8.6.98 and 9.10.3-alpha.1.

Recommended defensive actions

• Verify Parse Server version and assess exposure
• Review and update affected versions to 8.6.98 or 9.10.3-alpha.1
• Monitor for potential session creation and _Session class modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and potential exposure. Defenders should verify inventory and assess exposure of Parse Server deployments, especially for versions before 8.6.98 and 9.10.3-alpha.1. The vulnerability allows for potential unauthorized session creation and possible modifications to the _Session class. Evidence limits and source grounding indicate a need for careful review of affected versions and potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.