{"id":"CVE-2026-126392","aliases":[],"cve":{"records":[{"id":"CVE-2026-126392","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-10T21:30:16.910Z","published":"2026-11-13T09:35:53.670Z","modified":"2026-11-13T20:23:17.302Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:35:53.670Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T20:23:17.302Z"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-4m87-fqwv-2m8v","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.8-alpha.1-information-disclosure-via-dot-notation-update","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-203","description":"Observable Discrepancy","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*","versionStartIncluding":"9.10.6-alpha.1","versionEndExcluding":"9.10.8-alpha.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*","versionStartIncluding":"8.6.109","versionEndExcluding":"8.6.118"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T20:23:03.905458Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.","score":3.1,"severity":"low","published":"2026-11-13T09:35:53.670Z","modified":"2026-11-13T20:23:17.302Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"parse-community","name":"parse-server","platforms":[],"versions":[{"version":"9.10.6-alpha.1","status":"affected","lessThan":"9.10.8-alpha.1","versionType":"semver"},{"version":"9.10.8-alpha.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","packageIdentity":{"ecosystem":"npm","name":"parse-server"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-126392"},{"vendor":"parse-community","name":"parse-server","platforms":[],"versions":[{"version":"8.6.109","status":"affected","lessThan":"8.6.118","versionType":"semver"},{"version":"8.6.118","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","packageIdentity":{"ecosystem":"npm","name":"parse-server"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-126392"}],"remediation":[],"references":["https://github.com/parse-community/parse-server/security/advisories/GHSA-4m87-fqwv-2m8v","https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.8-alpha.1-information-disclosure-via-dot-notation-update"],"sources":[{"name":"CVE","id":"CVE-2026-126392","modified":"2026-11-13T20:23:17.302Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-126392"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":2.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.1}],"sourceAffected":[],"observedAt":"2026-11-13T20:42:47.486Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T15:10:51.762Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T15:15:34.056Z","attemptedAt":"2026-11-13T15:15:34.056Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T15:15:32.508Z","attemptedAt":"2026-11-13T15:15:32.508Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T15:15:31.730Z","attemptedAt":"2026-11-13T15:15:31.730Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-126392","url":"https://www.first.org/epss/","probability":0.00283,"percentile":0.21087,"date":"2026-11-13","checkedAt":"2026-11-13T15:15:31.730Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125173","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125173","modified":"Nov 13, 2026, 9:35:53 AM","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T15:15:32.508Z"},{"source":"GitHub Advisory Database","id":"GHSA-pw7w-gqq9-3xpf","url":"https://github.com/advisories/GHSA-pw7w-gqq9-3xpf","modified":"2026-11-13T12:31:27Z","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-13T15:15:34.056Z"}],"aiSummary":{"text":"Parse Server versions 9.10.6-alpha.1 before 9.10.8-alpha.1 and 8.6.109 before 8.6.118 have an information disclosure vulnerability. Clients with write access can infer field existence by sending updates with dot notation operations. Attackers need write but not read access to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T12:56:07.924Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-126392"}]}}