Parse Server CVE-2026-121415

Three concrete conditions must hold. (1) The Parse Server deployment must use the MongoDB storage adapter - PostgreSQL is not affected because it rejects such writes. (2) The attacker must have write access to the target object: either the class-level permissions/ACL allow public writes (enabling unauthenticated exploitation) or the caller otherwise holds write access. (3) The write must use a dot notation key whose value is null and whose parent field is a non-object/non-array field - a Pointer, Number, String, Date, or Boolean field, or an internal field such as createdAt/updatedAt or ACL (e.g. {"owner.sub": null} or {"createdAt.sub": null}). Limiting factors: it is MongoDB-specific, requires write permission on the class/object, and affected deployments can reduce exposure by restricting writes via class-level permissions and ACLs or by rejecting such field names in a beforeSave trigger; the vendor states there is no configuration workaround and upgrading is the recommended complete fix.

This is a genuine but moderate-priority integrity/availability issue, not a critical one. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L, base 6.3) describes a network-reachable flaw with no privileges required (PR:N) but with an attack requirement present (AT:P), which aligns with the advisory's condition that the target class or object must permit the write - either public writes for unauthenticated clients or any client already holding write access. There is NO confidentiality impact (VC:N), and the vendor scored only limited availability impact (VA:L); in my own assessment the data-corruption aspect also warrants a limited integrity impact. KEV status is NOT listed in the input, so this is not confirmed actively exploited. No EPSS score was provided, so exploitation probability cannot be quantified from the data. The references include a GitHub Security Advisory, two fix PRs, and a VulnCheck advisory, but none is marked as confirmed working exploit code, so no public exploit is identified. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-non-urgent fix. Net: prioritize patching within a normal cycle, weighted higher for MongoDB-backed deployments that allow public or broad write access.

An attacker with write access to a MongoDB-backed Parse Server class - including an unauthenticated client where class-level permissions or ACLs permit public writes - sends an object create or update containing a dot notation key with a null value beneath a scalar field (e.g. {"owner.sub": null}). Field type validation is skipped, so MongoDB stores a sub-document under that field, corrupting a Pointer/Number/String/Date/Boolean value, or if aimed at an internal date field makes the object fail every read. No public exploit code is identified at time of analysis, though the trigger pattern is fully described in the vendor advisory and regression tests.