{"id":"CVE-2026-122301","kind":"vulnerability","aliases":["CVE-2026-122301"],"related":[],"title":"Parse Server: object create responses leak fields to callers without read access","description":"Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.","summary":"Parse Server returns field values in the response to object creation, even for callers who lack read access to the created object under class permissions or its ACL. An attacker who has create permission can read values set by Cloud Code triggers, schema defaults and the class default ACL.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["baas","backend","node.js","package","parse-server"],"not_affected_if":["default-config","no-create-only-users"],"how_to_check":"- Check the installed `parse-server` version in the project's lockfile or with `npm ls parse-server`\n- Look for Parse Server 8.x or 9.x releases in the affected ranges below\n- Review whether Cloud Code triggers or schema defaults write sensitive values into objects that create-only users can make","fix":"- parse-server 8.x: move to `8.6.114` or later\n- parse-server 9.0.x: move to `9.10.6-alpha.6` or later","status":"open","published_at":"2026-11-05T03:17:21+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","triaged_at":"2026-11-05T03:33:30+00:00","updated_at":"2026-11-05T03:33:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T03:33:30Z","model":"claude-haiku-5-5","output":{"fix":"- parse-server 8.x: move to `8.6.114` or later\n- parse-server 9.0.x: move to `9.10.6-alpha.6` or later","reach":"internet","title":"Parse Server: object create responses leak fields to callers without read access","impact":"low","summary":"Parse Server returns field values in the response to object creation, even for callers who lack read access to the created object under class permissions or its ACL. An attacker who has create permission can read values set by Cloud Code triggers, schema defaults and the class default ACL.","audience":"developers","category":"package","nicknames":[],"who_cares":["parse-server","node.js","backend","baas"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"create-only callers read trigger-set and default field values","analyst_note":"","how_to_check":"- Check the installed `parse-server` version in the project's lockfile or with `npm ls parse-server`\n- Look for Parse Server 8.x or 9.x releases in the affected ranges below\n- Review whether Cloud Code triggers or schema defaults write sensitive values into objects that create-only users can make","plain_action":"","needs_analyst":false,"not_affected_if":["no-create-only-users","default-config"],"who_is_affected":"Applications running Parse Server versions before 8.6.114 or 9.x before 9.10.6-alpha.6 that let some users create objects without read access to them. Exposure depends on sensitive values set by triggers, defaults or default ACLs that a create-only caller can see in the response. Deployments that do not grant create-only access to untrusted callers are at lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000723,"input_tokens":4286,"output_tokens":588,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-122301':15A,18A '-2026':14A,17A '8.6.114':78C '9.0.0':80C '9.10.6':82C 'access':12A,43B,96C 'acl':53B,74B,110C,133C 'alpha.6':83C 'attack':55B,112C 'baa':19B 'backend':20B 'caller':9A,39B,92C 'class':49B,72B,103C,131C 'class-level':102C 'cloud':65B,124C 'code':66B,125C 'creat':4A,46B,58B,89C,99C,114C,117C 'creation':36B 'cve':13A,16A 'default':69B,73B,128C,132C 'even':37B 'field':7A,29B,85C 'lack':41B,94C 'leak':6A 'level':104C 'node.js':21B 'object':3A,35B,47B,88C,100C,108C,118C 'obtain':120C 'packag':22B 'pars':1A,24B,26B,75C 'parse-serv':23B 'permiss':50B,59B,105C,115C 'read':11A,42B,61B,95C 'respons':5A,33B,90C 'return':28B,84C 'schema':68B,127C 'server':2A,25B,27B,76C 'set':63B,122C 'trigger':67B,126C 'valu':30B,62B,86C,121C 'without':10A","nicknames":[],"mitigations":[],"who_affected":"Applications running Parse Server versions before 8.6.114 or 9.x before 9.10.6-alpha.6 that let some users create objects without read access to them. Exposure depends on sensitive values set by triggers, defaults or default ACLs that a create-only caller can see in the response. Deployments that do not grant create-only access to untrusted callers are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["baas","backend","low","nodejs","package","parseserver"],"campaign_type":null,"first_public_at":"2026-10-21T17:50:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122301","severity":null,"published_at":"2026-11-05T03:17:21+00:00","modified_at":"2026-11-05T03:17:21+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","fetched_at":"2026-11-05T03:31:40+00:00","note":null}],"documents":[{"id":72679,"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qq3r-ppqq-rh6m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T17:50:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":72680,"url":"https://www.vulncheck.com/advisories/parse-server-before-8.6.114-and-9.0.0-before-9.10.6-alpha.6-information-disclosure-via-object-create-response","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}