{"id":"CVE-2026-120310","kind":"vulnerability","aliases":["CVE-2026-120310"],"related":[],"title":"Parse Server: object update responses leak stored field values to write-only clients","description":"Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.","summary":"Parse Server returns stored field values in object update responses without checking read permission. A client allowed to update an object but not read it can see its data, including results of atomic operations and values set by Cloud Code triggers.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend-as-a-service","node.js","package","parse-server","self-hosted"],"not_affected_if":["all-writes-also-readable","default-config"],"how_to_check":"- Check the installed version with `npm ls parse-server` or the `version` field in `node_modules/parse-server/package.json`.\n- Look for classes where write permission is granted but read permission or object ACL read access is withheld.","fix":"- Parse Server `8.6.109` and later in the 8.x line.\n- Parse Server `9.10.6-alpha.1` and later in the 9.x line; `9.0.0` through `9.10.6-alpha.0` are affected.","status":"open","published_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","triaged_at":"2026-11-02T03:31:58+00:00","updated_at":"2026-11-02T03:31:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T03:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server `8.6.109` and later in the 8.x line.\n- Parse Server `9.10.6-alpha.1` and later in the 9.x line; `9.0.0` through `9.10.6-alpha.0` are affected.","reach":"internet","title":"Parse Server: object update responses leak stored field values to write-only clients","impact":"low","summary":"Parse Server returns stored field values in object update responses without checking read permission. A client allowed to update an object but not read it can see its data, including results of atomic operations and values set by Cloud Code triggers.","audience":"developers","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted","backend-as-a-service"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"write-only clients read stored object field values","analyst_note":"","how_to_check":"- Check the installed version with `npm ls parse-server` or the `version` field in `node_modules/parse-server/package.json`.\n- Look for classes where write permission is granted but read permission or object ACL read access is withheld.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","all-writes-also-readable"],"who_is_affected":"Applications that run Parse Server and use class-level permissions or object ACLs that let clients update objects without letting them read them. Deployments where every writable object is also readable by the same client are not exposed in the same way. The sources do not say whether managed Parse hosting is patched.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000693,"input_tokens":4187,"output_tokens":548,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-120310':17A,20A '-2026':16A,19A '8.6.109':78C '9.0.0':80C '9.10.6':82C 'access':95C 'acl':105C 'add':126C 'adduniqu':127C 'allow':50B,106C 'alpha.1':83C 'atom':66B,122C 'attack':115C 'backend':22B 'backend-as-a-servic':21B 'certain':141C 'check':45B,93C 'class':100C 'class-level':99C 'client':14A,49B,97C 'cloud':72B,129C 'code':73B,130C 'condit':142C 'cve':15A,18A 'data':62B,114C 'dot':137C 'field':8A,38B,86C,147C 'host':33B 'includ':63B 'increment':125C 'key':139C 'leak':6A 'level':101C 'node.js':26B 'notat':138C 'object':3A,41B,54B,89C,104C,113C,119C 'oper':67B,123C 'packag':27B 'parent':146C 'pars':1A,29B,34B,75C 'parse-serv':28B 'permiss':47B,102C 'read':46B,57B,94C,110C,121C 'remov':128C 'respons':5A,43B,91C 'result':64B,124C 'return':36B,84C 'see':60B,112C 'self':32B 'self-host':31B 'server':2A,30B,35B,76C 'servic':25B 'set':70B,133C 'store':7A,37B,85C,145C 'trigger':74B,132C 'trigger-set':131C 'updat':4A,42B,52B,90C,107C,117C 'valu':9A,39B,69B,87C,134C 'whole':144C 'whose':98C 'without':44B,92C 'write':12A 'write-on':11A","nicknames":[],"mitigations":[],"who_affected":"Applications that run Parse Server and use class-level permissions or object ACLs that let clients update objects without letting them read them. Deployments where every writable object is also readable by the same client are not exposed in the same way. The sources do not say whether managed Parse hosting is patched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backendasaservice","low","nodejs","package","parseserver","selfhosted"],"first_public_at":"2026-11-02T03:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120310","severity":null,"published_at":"2026-11-02T03:17:28+00:00","modified_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","fetched_at":"2026-11-02T03:31:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}