CVE-2026-109954

Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

En bref

Sévérité: HIGH 8.3
EPSS: EPSS 0.22 % · centile 12 (2026-10-27)
État: PUBLISHED
Publiée: 2026-10-13
Mise à jour: 2026-10-13
Attribuée par: VulnCheck
Statut NVD: Awaiting Analysis

Description

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H	VulnCheck
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H	NVD · disclosure@vulncheck.com (Secondary)

Faiblesses (CWE)

CWE-362

Références européennes

ENISA EUVD · EUVD-2026-98658
GCVE · GCVE-0-2026-109954

Produits affectés

Produit	Versions
parse-community · parse-server	affected 9.0.0 < 9.10.2-alpha.5 ; unaffected 9.10.2-alpha.5
parse-community · parse-server	affected 5.4.0 < 8.6.96 ; unaffected 8.6.96

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD