Parse Server exposes object fields in create responses
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object. An attacker with create permission can create objects to read values set by Cloud Code triggers, schema defaults, and the class default ACL, a flaw classified as CWE-200. The attacker needs low privileges and no user interaction, and the vector rates the confidentiality impact as low.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| parse-community | parse-server | 9.0.0 to before 9.10.6-alpha.6 | 9.10.6-alpha.6 | Patch available | CNA |
| parse-community | parse-server | before 8.6.114 | 8.6.114 | Patch available | CNA |
- parse-server Vendorparse-community Affected 9.0.0 to before 9.10.6-alpha.6 Fixed in 9.10.6-alpha.6 Patch available CNA
- parse-server Vendorparse-community Affected before 8.6.114 Fixed in 8.6.114 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:* | — | — | parse-community |
- cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:* Versions — — ·parse-community
Remediation
Upgrade parse-server to 8.6.114 for the 8.x line and to 9.10.6-alpha.6 for the 9.x line.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA parse-server (parse-community) Fixed in 9.10.6-alpha.6
- Fix · CNA parse-server (parse-community) Fixed in 8.6.114
Timeline
- 2026-11-05 Threatist record created from CVE-2026-122301
- 2026-11-05 Alias added: GHSA-9cq8-mq5q-gphm
References
More parse-community vulnerabilities
- TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
- TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
- TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
- TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
- TI-2025-35510 parse is a package designed to parse JavaScript SDK. CVSS 3.1MEDIUM 6.5
- TI-2024-26265 ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-122301 · CVE Program
- CVE-2026-122301 · NVD
- FIRST EPSS
- GHSA-9cq8-mq5q-gphm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences