CVE-2026-124425 · Package
NO FIX YET · SEE WHAT TO DO
Parse Server 8.6.109 to before 8.6.116 and 9.10.6-alpha.1 to before 9.10.7-alpha.2 mark fields as deleted in create or update responses based on stored values the caller cannot read. An attacker with write-only access to an object can read those markers to infer whether protected fields hold values.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Parse Server with object-level permissions where some users can write to objects but not read certain protected fields. Exposure depends on the data model and how protected fields are used; deployments without write-only access patterns have little to leak.
Not affected if default-config, no-write-only-access
Who cares node, parse-server, self-hosted
Unknown from the sources.
8.6.116 (8.x line)9.10.7-alpha.2 (9.x alpha line)Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.