Live › vulnerability › CVE-2026-119125
Parse Server returns the stored value of a field that a beforeSave trigger reverted, in object update responses, even to clients without read access. An authenticated client can read protected values, including its own raw MFA authData when protectedFieldsTriggerExempt is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications running Parse Server with beforeSave triggers that revert fields, particularly where users can update their own objects. The exposure is greater when protectedFieldsTriggerExempt is enabled, since raw MFA authData can then be returned. Applications without such triggers or without authenticated user writes are less exposed.
No product ranges from the sources yet.
parse (Parse Server) version in your package.json or lockfile; affected versions are before 8.6.107 and 9.0.0 through 9.10.5-alpha.8.revert() or use constant: true validators on protected fields.protectedFieldsTriggerExempt is enabled in your Parse Server configuration.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-119125")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.