{"id":"CVE-2026-119125","kind":"vulnerability","aliases":["CVE-2026-119125"],"related":[],"title":"Parse Server: update responses leak fields that a beforeSave trigger reverted","description":"Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled.","summary":"Parse Server returns the stored value of a field that a beforeSave trigger reverted, in object update responses, even to clients without read access. An authenticated client can read protected values, including its own raw MFA authData when protectedFieldsTriggerExempt is enabled.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","package","parse-server","self-hosted"],"not_affected_if":["no-beforesave-revert","protectedfieldstriggerexempt-disabled"],"how_to_check":"- Check the installed `parse` (Parse Server) version in your package.json or lockfile; affected versions are before `8.6.107` and `9.0.0` through `9.10.5-alpha.8`.\n- Look for beforeSave triggers that call `revert()` or use `constant: true` validators on protected fields.\n- Check whether `protectedFieldsTriggerExempt` is enabled in your Parse Server configuration.","fix":null,"status":"open","published_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","triaged_at":"2026-10-29T16:32:08+00:00","updated_at":"2026-10-29T16:32:08+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:32:08Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server before `8.6.107`: move to `8.6.107` or later.\n- Parse Server `9.0.0` through `9.10.4`: move to `9.10.5-alpha.8` or later.","reach":"internet","title":"Parse Server: update responses leak fields that a beforeSave trigger reverted","impact":"medium","summary":"Parse Server returns the stored value of a field that a beforeSave trigger reverted, in object update responses, even to clients without read access. An authenticated client can read protected values, including its own raw MFA authData when protectedFieldsTriggerExempt is enabled.","audience":"developers","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read protected fields and raw MFA authData","analyst_note":"","how_to_check":"- Check the installed `parse` (Parse Server) version in your package.json or lockfile; affected versions are before `8.6.107` and `9.0.0` through `9.10.5-alpha.8`.\n- Look for beforeSave triggers that call `revert()` or use `constant: true` validators on protected fields.\n- Check whether `protectedFieldsTriggerExempt` is enabled in your Parse Server configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["no-beforesave-revert","protectedfieldstriggerexempt-disabled"],"who_is_affected":"Applications running Parse Server with beforeSave triggers that revert fields, particularly where users can update their own objects. The exposure is greater when protectedFieldsTriggerExempt is enabled, since raw MFA authData can then be returned. Applications without such triggers or without authenticated user writes are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000749,"input_tokens":4191,"output_tokens":659,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119125':14A,17A '-2026':13A,16A '8.6.107':70C '9.0.0':72C '9.10.5':74C 'abl':106C 'access':49B,97C 'account':131C 'alpha.8':75C 'authdata':62B,135C 'authent':51B,104C 'beforesav':9A,37B,86C,112C 'client':46B,52B,94C,105C 'constant':121C 'cve':12A,15A 'enabl':66B,139C 'even':44B,92C 'field':6A,34B,82C,102C,116C 'host':25B 'includ':57B,128C 'leak':5A 'mfa':61B,134C 'node.js':18B 'object':41B,89C,100C,110C 'packag':19B 'pars':1A,21B,26B,67C 'parse-serv':20B 'protect':55B,126C 'protectedfieldstriggerexempt':64B,137C 'raw':60B,133C 'read':48B,54B,96C,125C 'respons':4A,43B,91C 'return':28B,76C 'revert':11A,39B,83C,114C,118C 'self':24B 'self-host':23B 'server':2A,22B,27B,68C 'store':30B,78C 'trigger':10A,38B,87C,113C 'true':122C 'updat':3A,42B,90C,108C 'valid':123C 'valu':31B,56B,79C,127C 'via':117C 'whose':111C 'without':47B,95C","nicknames":[],"mitigations":[],"who_affected":"Applications running Parse Server with beforeSave triggers that revert fields, particularly where users can update their own objects. The exposure is greater when protectedFieldsTriggerExempt is enabled, since raw MFA authData can then be returned. Applications without such triggers or without authenticated user writes are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119125","severity":null,"published_at":"2026-10-29T16:18:05+00:00","modified_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","fetched_at":"2026-10-29T16:25:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}