Parse Server CVE-2026-116164

Two distinct conditions. (1) Query-disruption DoS: requires a client permitted to create objects in a given class AND a MongoDB storage backend; the client stores an object containing a reserved internal field name, which makes every read of that object fail and breaks queries on that class for all users until the field is manually removed from MongoDB. (2) Security-policy bypass: requires a user able to write to their own account/records; they clear internal fields such as account lockout state or password history, circumventing lockout and password-policy settings - this affects BOTH MongoDB and PostgreSQL deployments. Limiting factors: the attacker must already have client write access to the target class/records (not arbitrary anonymous access unless CLPs permit it), the full query-disruption impact applies only to MongoDB, and the issue is neutralized by upgrading or by registering a beforeSave Cloud Code trigger (even an empty one) for every client-writable class including _User.

Severity is moderate: the input CVSS 4.0 base score is 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N) with impact limited to low availability on the vulnerable system (VA:L) and no stated confidentiality or integrity impact in the supplied vector. No EPSS probability was provided, the CVE is not listed in CISA KEV, and no working exploit code is referenced - only the GHSA and VulnCheck advisories and the fix PRs - so there is no public exploit identified at time of analysis. The vuln.today decision label is this_month, consistent with a real but non-emergency issue. A notable conflict exists between the signals: the CVSS vector encodes PR:N (unauthenticated), yet the description and advisory explicitly require 'a client that is allowed to create objects in a class' or write to 'records they are allowed to write,' which implies at least client/application-level write authorization - verify the true privilege requirement against the vendor advisory before treating this as fully unauthenticated. The supplied vector also records VI:N despite the described ability to clear internal fields (account lockout state, password history), which is an integrity/security-control impact that the input vector appears to understate. Net: a legitimate priority for Parse Server operators on MongoDB (data-integrity DoS of queries for all users on a class) and a security-policy bypass on both MongoDB and PostgreSQL, but not a drop-everything emergency given no active exploitation and no confirmed public exploit.

An attacker who can write objects to a Parse Server class (on a MongoDB deployment) submits an object containing a reserved internal field name, after which every subsequent read of that object fails and queries on that entire class break for all users until the field is removed from the database. Separately, a user writes to their own account record to clear internal fields such as lockout state or password history, bypassing account-lockout and password-policy enforcement. No working public exploit code is referenced, and the precise trigger field names are not detailed in the available sources.