Advisory · CVE-2026-100631
Parse Server lets anyone delete every device registration with no credentials
Parse Server before 8.6.90 (and 9.0.0 before 9.10.1-alpha.9) does not validate the type of client-supplied installation fields before building database queries in the device-token deduplication logic. An unauthenticated remote attacker who knows only the public application ID can inject query operators to make the elevated deduplication cleanup delete every device registration in the application, killing push delivery until every client re-registers. No workaround other than upgrading exists.
- Vendor
- parse-community
- Product
- Parse Server
- Identifier / CWE
- CVE-2026-100631
CWE-943 - Action timing
- Immediate
Explain it like I’m five
The front desk throws away duplicate sign-in cards using whatever handwriting the visitor provides as instructions. A stranger writes 'throw away ALL the cards' in the margin, and the clerk, working with the manager's authority, does exactly that.
- 01Crafted fields
The attacker submits installation fields with non-string values containing query operators, using only the public application ID.
- 02Operator injection
The device-token deduplication logic builds database queries from the unvalidated fields.
- 03Elevated cleanup
The cleanup runs with elevated privileges before class-level permissions are evaluated.
- 04Mass deletion
Every device registration in the application is deleted; push notifications stop until clients re-register.
What happened
Parse Server before 8.6.90 (and 9.0.0 before 9.10.1-alpha.9) does not validate the type of client-supplied installation fields before building database queries in the device-token deduplication logic (CVE-2026-100631, CVSS 8.7). An unauthenticated remote attacker who knows only the public application ID can inject query operators through those fields. The resulting queries execute in an elevated deduplication cleanup that runs before class-level permissions are evaluated, and a crafted request makes that cleanup delete every device registration in the application, killing push notification delivery until every client re-registers. There is no workaround other than upgrading.
What to do
- Upgrade Parse Server to 8.6.90 or later (or 9.10.1-alpha.9 or later on the 9.x line).
- Audit your installations collection for unexpected mass deletions.
- Monitor push delivery health; a sudden drop in registered devices is the signature of this attack.
- If you cannot upgrade immediately, consider rate-limiting and anomaly-monitoring the installations endpoints, though the vendor states no supported workaround exists.
Management note
No authentication, public application ID only, and the blast radius is every push token you have. If push notifications are business-critical, this upgrade belongs in the next maintenance window, not the next quarter.