---
id: "CVE-2026-119570"
kind: "vulnerability"
aliases: ["CVE-2026-119570"]
title: "Parse Server: protected field values leak to clients through save responses"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node.js", "package", "parse-server", "self-hosted"]
not_affected_if: ["default-config", "patched-version"]
published_at: "2026-10-30T14:16:45+00:00"
first_seen_at: "2026-10-30T14:30:53+00:00"
updated_at: "2026-10-30T14:33:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119570", "first_seen_at": "2026-10-30T14:30:53+00:00"}]
---

# Parse Server: protected field values leak to clients through save responses

Parse Server versions from 9.7.0 before 9.10.5-alpha.7 return values that beforeSave triggers write beneath protected fields when dot-notation keys are used. A client with create or update permission can read those values in the save response when protectedFieldsSaveResponseExempt is set to false.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Parse Server version (for example `npm ls parse-server`) and see whether it falls in 9.7.0 up to 9.10.5-alpha.7.
- Look for `protectedFieldsSaveResponseExempt` set to `false` in the server configuration.
- Look for beforeSave triggers that write dot-notation keys under protected fields.

## Fix

- Parse Server: move to `9.10.5-alpha.7` or later, per the sources' stated fixed range.

## Timeline

- 2026-10-30T14:30:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119570

## From the sources

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_