Information Disclosure in Parse Server by Vendor Parse Community
CVE-2026-119125

2.3LOW

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119125?

An issue in Parse Server allows authenticated clients to access sensitive data through object updates. Specifically, versions prior to 8.6.107 and 9.0.0 versions before 9.10.5-alpha.8 can improperly return stored values from fields that a beforeSave trigger has reverted. This flaw enables clients, even without explicit read access, to retrieve protected information, such as the raw multi-factor authentication (MFA) data for their accounts, if the protectedFieldsTriggerExempt setting is activated.

Affected Version(s)

parse-server 9.0.0 < 9.10.5-alpha.8

parse-server 0 < 8.6.107

parse-server 9.10.5-alpha.8

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-before-...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.