Live › vulnerability › CVE-2026-119570
Parse Server versions from 9.7.0 before 9.10.5-alpha.7 return values that beforeSave triggers write beneath protected fields when dot-notation keys are used. A client with create or update permission can read those values in the save response when protectedFieldsSaveResponseExempt is set to false.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running Parse Server from 9.7.0 before 9.10.5-alpha.7 that have protectedFieldsSaveResponseExempt set to false and beforeSave triggers writing dot-notation keys beneath protected fields. Clients with create or update permission on those classes can read the trigger-written values. Deployments on other versions, or with the exempt setting enabled, are not described as affected.
No product ranges from the sources yet.
npm ls parse-server) and see whether it falls in 9.7.0 up to 9.10.5-alpha.7.protectedFieldsSaveResponseExempt set to false in the server configuration.9.10.5-alpha.7 or later, per the sources' stated fixed range.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.
This page as .md · .json · in your agent: get_signal("CVE-2026-119570")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.