Is CVE-2026-112769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112769 being exploited in the wild.

How severe is CVE-2026-112769?

Informational severity, published 19 October 2026.

Which products and versions are affected?

Parse Community Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1.

How is CVE-2026-112769 attacked?

It is attacked over the network.

Am I affected by CVE-2026-112769?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112769: Parse Server session creation endpoint bypasses class-level permissions

CVE-2026-112769 · Severity: info · Published 2026-10-19

Parse Server is a backend platform that manages user sessions and data permissions. An authenticated user can bypass class-level permission controls to create additional sessions for their account or add fields to the session class, even when administrators have restricted these actions. These unauthorized sessions persist after the original session is logged out, potentially allowing attackers to maintain access or escalate their privileges contrary to deployment security policies.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-112769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112769 being exploited in the wild.
How severe is CVE-2026-112769?: Informational severity, published 19 October 2026.
Which products and versions are affected?: Parse Community Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1.
Is there a fix for CVE-2026-112769?: Yes: fixed in Parse Server 8.6.98, 9.10.3-alpha.1. Until then: If clients do not need to create sessions, block REST API POST requests to /sessions and /classes/_Session before they reach Parse Server (including in batch requests), and disable the GraphQL API create mutation of the _Session class with the GraphQL configuration mutation: { create: false }.</anigation> <parameter name="timeline">[{"kind":"advisory","at":"2026-10-04"},{"kind":"disclosed","at":"2026-10-19"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112769 attacked?: It is attacked over the network.
Am I affected by CVE-2026-112769?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.98, 9.10.3-alpha.1

If clients do not need to create sessions, block REST API POST requests to /sessions and /classes/_Session before they reach Parse Server (including in batch requests), and disable the GraphQL API create mutation of the _Session class with the GraphQL configuration mutation: { create: false }.</anigation> <parameter name="timeline">[{"kind":"advisory","at":"2026-10-04"},{"kind":"disclosed","at":"2026-10-19"}]

Technical details

The _Session class endpoint fails to enforce create and addField class-level permissions during session creation, allowing authenticated users to bypass configured access controls. An attacker with a valid user session token can POST to /sessions or /classes/_Session to create new sessions or modify the session schema. The session is created before permissions are validated, and in some Parse Server versions the session token is returned in the response before rejection occurs, enabling unauthorized session persistence.

Affected products

parse-community Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.