Live › vulnerability › CVE-2026-119571
Parse Server applies updates to an _Installation object to the installation named in a request header instead of the targeted one, when protectedFieldsTriggerExempt is enabled. An attacker who knows another installation's object ID can make a beforeSave trigger process that installation's protected fields.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running Parse Server from 9.7.0 before 9.10.5-alpha.10 that have protectedFieldsTriggerExempt enabled and use beforeSave triggers on _Installation. Exposure also requires that an attacker can learn another installation's object ID. Servers on other versions or with the option disabled are not affected by this description.
No product ranges from the sources yet.
package.json or npm ls parse-server; affected range is 9.7.0 up to but not including 9.10.5-alpha.10protectedFieldsTriggerExempt is enabled in the server configuration9.10.5-alpha.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
This page as .md · .json · in your agent: get_signal("CVE-2026-119571")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.