---
id: "CVE-2026-122301"
kind: "vulnerability"
aliases: ["CVE-2026-122301"]
title: "Parse Server: object create responses leak fields to callers without read access"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["baas", "backend", "node.js", "package", "parse-server"]
not_affected_if: ["default-config", "no-create-only-users"]
published_at: "2026-11-05T03:17:21+00:00"
first_seen_at: "2026-11-05T03:31:40+00:00"
updated_at: "2026-11-05T03:33:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122301", "first_seen_at": "2026-11-05T03:31:40+00:00"}]
exploit_sources: []
---

# Parse Server: object create responses leak fields to callers without read access

Parse Server returns field values in the response to object creation, even for callers who lack read access to the created object under class permissions or its ACL. An attacker who has create permission can read values set by Cloud Code triggers, schema defaults and the class default ACL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `parse-server` version in the project's lockfile or with `npm ls parse-server`
- Look for Parse Server 8.x or 9.x releases in the affected ranges below
- Review whether Cloud Code triggers or schema defaults write sensitive values into objects that create-only users can make

## Fix

- parse-server 8.x: move to `8.6.114` or later
- parse-server 9.0.x: move to `9.10.6-alpha.6` or later

## Timeline

- 2026-11-05T03:31:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122301

## Documents

- [advisory] Vendor advisory: github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-qq3r-ppqq-rh6m
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/parse-server-before-8.6.114-and-9.0.0-before-9.10.6-alpha.6-information-disclosure-via-object-create-response

## From the sources

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_