Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 9.10.6-alpha.1, 8.6.109
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects Parse Server 9.0.0 before 9.10.6-alpha.1 and versions before 8.6.109 Client can update the object but cannot read it, via class-level permissions allowing update but not get, or an object ACL granting write but not read For dot notation keys, the whole parent field is exposed only when the class has a beforeSave or afterSave trigger or, on MongoDB, for an operation on an array index
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 10/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 9.10.6-alpha.1, 8.6.109
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Parse Server, an open-source backend framework for Node.js applications, is affected. A client with permission to update an object but not read it can receive stored data from that object in the update response, including results of atomic operations and values set by Cloud Code triggers.
Read the original description
Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.
What to do
Check whether your setup matches what the bug needs.
Affects Parse Server 9.0.0 before 9.10.6-alpha.1 and versions before 8.6.109 Client can update the object but cannot read it, via class-level permissions allowing update but not get, or an object ACL granting write but not read For dot notation keys, the whole parent field is exposed only when the class has a beforeSave or afterSave trigger or, on MongoDB, for an operation on an array indexUpgrade to a fixed version: 9.10.6-alpha.1, 8.6.109.
Workaround: Do not grant update permission through class-level permissions, or write access through object ACLs, to clients that must not read the stored values of the object.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- parse-community parse-server
From 9.0.0 · fixed in 9.10.6-alpha.1
- parse-community parse-server
fixed in 8.6.109
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120310
What does this mean?
Parse Server can return stored field values in the response to an object update, even when the client has no permission to read the object. This exposes data a client was not meant to see. Affected values include atomic operation results, values set by Cloud Code triggers, and in some cases the whole parent field for dot notation keys.Source: vulncheck.com, github.com
Am I affected, and how do I check?
Parse Server 9.0.0 before 9.10.6-alpha.1 and all versions before 8.6.109 are affected. The exposure needs a client that can update an object but cannot read it, through class-level permissions that allow update but not get, or an object ACL that grants write but not read. Dot notation keys expose the whole parent field only when the class has a beforeSave or afterSave trigger, or on MongoDB for an operation on an array index.Source: vulncheck.com, github.com
What should I do about it?
Upgrade to Parse Server 8.6.109 or 9.10.6-alpha.1 or later, depending on the release line in use.Source: vulncheck.com, github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data