Executive brief
Parse Server is an open source backend that manages user data and push notifications for mobile and web applications. An unauthenticated attacker can delete all device registrations in an application using ordinary HTTP requests, preventing push notifications from being delivered until clients re-register. Only the application's public ID is needed—no password, session token, or special key is required.
Technical details
The device token deduplication logic for installation records fails to validate that client-supplied fields are strings before using them to build database queries, allowing an attacker to inject query operators. The cleanup runs with elevated privileges before class-level permissions are evaluated, enabling deletion of all registrations or an attacker-chosen subset. The fix validates field types and scopes the deduplication cleanup to the calling application.
Affected products
- Parse Community Parse Server <8.6.90 and 9.0.0 to <9.10.1-alpha.9
Timeline
- 2026-09-26: disclosed