{"id":"CVE-2026-119570","kind":"vulnerability","aliases":["CVE-2026-119570"],"related":[],"title":"Parse Server: protected field values leak to clients through save responses","description":"Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.","summary":"Parse Server versions from 9.7.0 before 9.10.5-alpha.7 return values that beforeSave triggers write beneath protected fields when dot-notation keys are used. A client with create or update permission can read those values in the save response when protectedFieldsSaveResponseExempt is set to false.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","package","parse-server","self-hosted"],"not_affected_if":["default-config","patched-version"],"how_to_check":"- Check the installed Parse Server version (for example `npm ls parse-server`) and see whether it falls in 9.7.0 up to 9.10.5-alpha.7.\n- Look for `protectedFieldsSaveResponseExempt` set to `false` in the server configuration.\n- Look for beforeSave triggers that write dot-notation keys under protected fields.","fix":"- Parse Server: move to `9.10.5-alpha.7` or later, per the sources' stated fixed range.","status":"open","published_at":"2026-10-30T14:16:45+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","triaged_at":"2026-10-30T14:33:03+00:00","updated_at":"2026-10-30T14:33:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T14:33:03Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server: move to `9.10.5-alpha.7` or later, per the sources' stated fixed range.","reach":"internet","title":"Parse Server: protected field values leak to clients through save responses","impact":"low","summary":"Parse Server versions from 9.7.0 before 9.10.5-alpha.7 return values that beforeSave triggers write beneath protected fields when dot-notation keys are used. A client with create or update permission can read those values in the save response when protectedFieldsSaveResponseExempt is set to false.","audience":"developers","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Clients read protected field values that triggers wrote to the database.","analyst_note":"","how_to_check":"- Check the installed Parse Server version (for example `npm ls parse-server`) and see whether it falls in 9.7.0 up to 9.10.5-alpha.7.\n- Look for `protectedFieldsSaveResponseExempt` set to `false` in the server configuration.\n- Look for beforeSave triggers that write dot-notation keys under protected fields.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","patched-version"],"who_is_affected":"Teams running Parse Server from 9.7.0 before 9.10.5-alpha.7 that have protectedFieldsSaveResponseExempt set to false and beforeSave triggers writing dot-notation keys beneath protected fields. Clients with create or update permission on those classes can read the trigger-written values. Deployments on other versions, or with the exempt setting enabled, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000727,"input_tokens":4154,"output_tokens":624,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119570':14A,17A '-2026':13A,16A '9.10.5':32B,76C '9.7.0':30B,74C 'allow':84C 'alpha.7':33B,77C 'beforesav':37B,93C 'beneath':40B,117C 'client':8A,51B,85C,105C 'contain':78C 'creat':53B,107C 'cve':12A,15A 'disclosur':81C 'dot':45B,96C 'dot-not':44B 'fals':70B,104C 'field':4A,42B,89C,120C 'host':25B 'inform':80C 'key':47B,98C 'leak':6A 'node.js':18B 'notat':46B,97C 'packag':19B 'pars':1A,21B,26B,71C 'parse-serv':20B 'permiss':56B,110C 'protect':3A,41B,88C,119C 'protectedfieldssaveresponseexempt':66B,100C 'read':58B,112C 'receiv':87C 'request':124C 'respons':11A,64B 'return':34B 'save':10A,63B 'self':24B 'self-host':23B 'server':2A,22B,27B,72C 'set':68B,102C 'trigger':38B,94C,115C 'updat':55B,109C 'use':49B,95C 'valu':5A,35B,60B,90C,113C 'version':28B 'vulner':82C 'write':39B,116C 'written':91C","nicknames":[],"mitigations":[],"who_affected":"Teams running Parse Server from 9.7.0 before 9.10.5-alpha.7 that have protectedFieldsSaveResponseExempt set to false and beforeSave triggers writing dot-notation keys beneath protected fields. Clients with create or update permission on those classes can read the trigger-written values. Deployments on other versions, or with the exempt setting enabled, are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T14:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119570","severity":null,"published_at":"2026-10-30T14:16:45+00:00","modified_at":"2026-10-30T14:16:45+00:00","first_seen_at":"2026-10-30T14:30:53+00:00","fetched_at":"2026-10-30T14:30:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}