CVE-2026-122301 · Package
NO FIX YET · SEE WHAT TO DO
Parse Server returns field values in the response to object creation, even for callers who lack read access to the created object under class permissions or its ACL. An attacker who has create permission can read values set by Cloud Code triggers, schema defaults and the class default ACL.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications running Parse Server versions before 8.6.114 or 9.x before 9.10.6-alpha.6 that let some users create objects without read access to them. Exposure depends on sensitive values set by triggers, defaults or default ACLs that a create-only caller can see in the response. Deployments that do not grant create-only access to untrusted callers are at lower risk.
Not affected if default-config, no-create-only-users
Who cares baas, backend, node.js, parse-server
parse-server version in the project's lockfile or with npm ls parse-server8.6.114 or later9.10.6-alpha.6 or laterParse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.