Parse Server EUVD-2026-113923

Exploitation requires a client that already holds write access to a Parse class (authenticated per PR:L). The attacker then sends a write request whose key is either a dot notation field key or an ACL entry name matching a built-in JavaScript object member - for example toString, valueOf or hasOwnProperty - which is expanded into an object without an own-property check. The advisory states the dot notation vector requires no special configuration, so default deployments are affected; the highest-impact keys __proto__ and constructor are already blocked by the default requestKeywordDenylist. Limiting factors: the attacker must possess class write capability, and impact is availability-only (service denial until restart). Multi-tenant processes serving several applications are affected across all of them, amplifying impact. There is no complete configuration-only workaround for the dot notation vector; the vendor states upgrading to the patched release is the recommended fix, with extending the denylist (while retaining defaults) to also reject toString/valueOf/hasOwnProperty offered only as a partial pre-upgrade mitigation.

This is a medium-severity, authenticated denial-of-service issue, not a high-priority emergency. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H) scores 6.0 and tells a coherent story: network-reachable (AV:N) but requiring low privileges (PR:L) - specifically a client that already holds class write access - with impact confined entirely to availability (VA:H) and no confidentiality or integrity impact (VC:N/VI:N). The AT:P flag reflects that the most severe outcome depends on the crafted key matching a specific built-in object member. The vuln.today priority is 'this_month', consistent with a serviceable-but-not-urgent DoS. No EPSS score is provided, the CVE is not listed in CISA KEV, and no exploit/PoC reference is present in the input - only vendor advisories (GHSA and VulnCheck) - so there is no public exploit identified at time of analysis. The practical risk is real for multi-tenant Parse Server deployments, because the advisory states the dot notation vector requires no special configuration and a single tenant's write can deny service across all applications sharing the process until restart; but the requirement for class write access and the availability-only impact keep this below credential-theft or RCE-class urgency. One data inconsistency to note: the input tags include 'Information Disclosure', which contradicts the CVSS impact metrics (VC:N - no confidentiality impact) and the advisory, which describes a denial of service only.

An attacker who holds write access to a Parse class (for example a registered client of a multi-tenant Parse Server) submits a write request containing a dot notation field key, or an ACL entry whose name matches a built-in JavaScript object member such as toString, valueOf or hasOwnProperty. Because user-controlled keys are expanded into objects without own-property checks, this corrupts a shared runtime prototype, and in the worst case a built-in function used throughout the process; subsequent unrelated requests from all clients then fail until the server is restarted. No public working exploit is identified in the provided sources; exploitation is remote over the network but requires the low-privilege class write capability (PR:L).