{"id":"CVE-2026-109954","state":"PUBLISHED","title":"Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference","description":"Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.","publishedAt":"2026-10-13T13:27:19.012Z","updatedAt":"2026-10-13T16:43:51.636Z","severity":{"score":8.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["parse-community parse-server"],"affected":[{"vendor":"parse-community","product":"parse-server","packageURL":"pkg:npm/parse-server","defaultStatus":"unaffected","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.10.2-alpha.5","versionType":"semver"},{"version":"9.10.2-alpha.5","status":"unaffected","versionType":"semver"}]},{"vendor":"parse-community","product":"parse-server","packageURL":"pkg:npm/parse-server","defaultStatus":"unaffected","versions":[{"version":"5.4.0","status":"affected","lessThan":"8.6.96","versionType":"semver"},{"version":"8.6.96","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv","https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/109xxx/CVE-2026-109954.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-109954","state":"PUBLISHED","datePublished":"2026-10-13T13:27:19.012Z","dateUpdated":"2026-10-13T16:43:51.636Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-13T11:25:25.214Z"},"containers":{"cna":{"title":"Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference","descriptions":[{"lang":"en","value":"Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail."}],"affected":[{"vendor":"parse-community","product":"parse-server","packageURL":"pkg:npm/parse-server","defaultStatus":"unaffected","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.10.2-alpha.5","versionType":"semver"},{"version":"9.10.2-alpha.5","status":"unaffected","versionType":"semver"}]},{"vendor":"parse-community","product":"parse-server","packageURL":"pkg:npm/parse-server","defaultStatus":"unaffected","versions":[{"version":"5.4.0","status":"affected","lessThan":"8.6.96","versionType":"semver"},{"version":"8.6.96","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-jhh9-hrgh-c9gv)"},{"url":"https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference","name":"VulnCheck Advisory: Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.3,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","description":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-13T13:27:19.012Z"},"datePublic":"2026-09-28T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.10.2-alpha.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.0","versionEndExcluding":"8.6.96"}]}]}],"credits":[{"lang":"en","value":"mtrezza","type":"coordinator"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-13T15:47:56.122445Z","id":"CVE-2026-109954","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-13T16:43:51.636Z"}}]}}}