Parse Server CVE-2026-100631

Exploitable against any Parse Server deployment that exposes the REST API to clients AND uses push notifications - this is the DEFAULT configuration, not a special mode. The only prerequisite is knowledge of the public application ID, which is intentionally distributed within client apps. The attacker submits non-string (e.g., object) values in installation/device-token fields to inject query operators into the deduplication cleanup, which executes with elevated privileges before class-level permissions are checked. No account, session token, master key, or user interaction is required. Limiting factors are minimal: deployments that do not use push notifications or do not expose the REST API to untrusted clients are not affected, and upgrading to 8.6.90 or 9.10.1-alpha.9 (which type-checks the fields and scopes cleanup to the calling app) fully remediates it.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk paper finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, fully unauthenticated exploitation with no user interaction and no special attack requirements - the attacker needs only the public application ID, which is by design distributed to every client app. The impact is a destructive, unrecoverable mass deletion of installation/device records, which the vendor scored as VI:H (integrity) while setting VA:N; this is arguably understated because deleted registrations halt push-notification delivery entirely until every client re-registers, which is a real availability loss (I assess A:H as well). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - but the combination of unauthenticated network reach, trivial complexity, default-configuration exposure, and a permanent destructive outcome makes this attractive and easy to weaponize regardless of the absent POC. Note the deduplication cleanup runs with elevated privileges BEFORE class-level permissions are evaluated, which is precisely why an unauthenticated caller can bypass the normal permission model. All key CVSS signals are internally consistent with the description; the only conflict is vendor VA:N versus the description's explicit push-outage impact.

An attacker who has obtained a target deployment's public application ID (embedded in every distributed client app) sends a crafted REST installation request with non-string values in the device-token/installation fields, injecting query operators into the deduplication logic. Because the cleanup runs with elevated privileges before class-level permissions apply, the malformed query matches and deletes every installation record - or an attacker-chosen subset - leaving the application unable to deliver push notifications until all clients re-register. No account, session token, master key, or user interaction is required; no public exploit code was identified at the time of analysis, but the attack is low-complexity and network-reachable.