---
id: "CVE-2026-120310"
kind: "vulnerability"
aliases: ["CVE-2026-120310"]
title: "Parse Server: object update responses leak stored field values to write-only clients"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backend-as-a-service", "node.js", "package", "parse-server", "self-hosted"]
not_affected_if: ["all-writes-also-readable", "default-config"]
published_at: "2026-11-02T03:17:28+00:00"
first_seen_at: "2026-11-02T03:31:21+00:00"
updated_at: "2026-11-02T03:31:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120310", "first_seen_at": "2026-11-02T03:31:21+00:00"}]
---

# Parse Server: object update responses leak stored field values to write-only clients

Parse Server returns stored field values in object update responses without checking read permission. A client allowed to update an object but not read it can see its data, including results of atomic operations and values set by Cloud Code triggers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls parse-server` or the `version` field in `node_modules/parse-server/package.json`.
- Look for classes where write permission is granted but read permission or object ACL read access is withheld.

## Fix

- Parse Server `8.6.109` and later in the 8.x line.
- Parse Server `9.10.6-alpha.1` and later in the 9.x line; `9.0.0` through `9.10.6-alpha.0` are affected.

## Timeline

- 2026-11-02T03:31:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120310

## From the sources

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_