CVE-2026-109954

Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

At a glance

Severity: HIGH 8.3
EPSS: EPSS 0.22 % · percentile 12 (2026-10-27)
State: PUBLISHED
Published: 2026-10-13
Updated: 2026-10-13
Assigner: VulnCheck
NVD status: Awaiting Analysis

Description

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

Scores

Version	Score	Vector	Scored by
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H	VulnCheck
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H	NVD · disclosure@vulncheck.com (Secondary)

Weaknesses (CWE)

CWE-362

European references

ENISA EUVD · EUVD-2026-98658
GCVE · GCVE-0-2026-109954

Affected products

Product	Versions
parse-community · parse-server	affected 9.0.0 < 9.10.2-alpha.5 ; unaffected 9.10.2-alpha.5
parse-community · parse-server	affected 5.4.0 < 8.6.96 ; unaffected 8.6.96

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD