{"id":"CVE-2026-119571","kind":"vulnerability","aliases":["CVE-2026-119571"],"related":[],"title":"Parse Server: installation authorization flaw lets attackers change other installations' protected fields","description":"Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.","summary":"Parse Server applies updates to an _Installation object to the installation named in a request header instead of the targeted one, when protectedFieldsTriggerExempt is enabled. An attacker who knows another installation's object ID can make a beforeSave trigger process that installation's protected fields.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","package","parse-server","self-hosted"],"not_affected_if":["default-config","outside-version-range"],"how_to_check":"- Check the Parse Server version in `package.json` or `npm ls parse-server`; affected range is `9.7.0` up to but not including `9.10.5-alpha.10`\n- Check whether `protectedFieldsTriggerExempt` is enabled in the server configuration","fix":"- Parse Server: move to `9.10.5-alpha.10` or later","status":"open","published_at":"2026-10-30T14:16:45+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:50+00:00","updated_at":"2026-10-30T14:32:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T14:32:50Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server: move to `9.10.5-alpha.10` or later","reach":"network","title":"Parse Server: installation authorization flaw lets attackers change other installations' protected fields","impact":"medium","summary":"Parse Server applies updates to an _Installation object to the installation named in a request header instead of the targeted one, when protectedFieldsTriggerExempt is enabled. An attacker who knows another installation's object ID can make a beforeSave trigger process that installation's protected fields.","audience":"businesses","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker alters protected fields of another app installation's record","analyst_note":"","how_to_check":"- Check the Parse Server version in `package.json` or `npm ls parse-server`; affected range is `9.7.0` up to but not including `9.10.5-alpha.10`\n- Check whether `protectedFieldsTriggerExempt` is enabled in the server configuration","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","outside-version-range"],"who_is_affected":"Teams running Parse Server from 9.7.0 before 9.10.5-alpha.10 that have protectedFieldsTriggerExempt enabled and use beforeSave triggers on _Installation. Exposure also requires that an attacker can learn another installation's object ID. Servers on other versions or with the option disabled are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4169,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119571':15A,18A '-2026':14A,17A '9.10.5':77C '9.7.0':75C 'address':87C 'alpha.10':78C 'anoth':56B,109C 'appli':29B,84C 'attack':7A,53B,107C 'author':4A,81C 'beforesav':64B,117C 'chang':8A 'contain':79C 'cve':13A,16A 'elsewher':127C 'enabl':51B,106C 'field':12A,71B,124C 'flaw':5A,82C 'header':42B,102C 'host':26B 'id':60B,90C,101C,113C 'instal':3A,10A,33B,37B,57B,68B,85C,93C,100C,110C,121C 'instead':43B 'know':55B,108C 'let':6A 'make':62B,115C 'name':38B,94C 'node.js':19B 'object':34B,59B,89C,112C 'one':47B 'packag':20B 'pars':1A,22B,27B,72C,99C 'parse-serv':21B 'process':66B,119C 'protect':11A,70B,123C 'protectedfieldstriggerexempt':49B,104C 'request':41B 'self':25B 'self-host':24B 'server':2A,23B,28B,73C 'target':46B 'trigger':65B,118C 'updat':30B,86C 'write':126C 'x':98C 'x-parse-installation-id':97C","nicknames":[],"mitigations":[],"who_affected":"Teams running Parse Server from 9.7.0 before 9.10.5-alpha.10 that have protectedFieldsTriggerExempt enabled and use beforeSave triggers on _Installation. Exposure also requires that an attacker can learn another installation's object ID. Servers on other versions or with the option disabled are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119571","severity":null,"published_at":"2026-10-30T14:16:45+00:00","modified_at":"2026-10-30T14:16:46+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}