{"id":"CVE-2026-124425","kind":"vulnerability","aliases":["CVE-2026-124425"],"related":[],"title":"Parse Server: create and update responses leak whether protected fields are set","description":"Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set.","summary":"Parse Server 8.6.109 to before 8.6.116 and 9.10.6-alpha.1 to before 9.10.7-alpha.2 mark fields as deleted in create or update responses based on stored values the caller cannot read. An attacker with write-only access to an object can read those markers to infer whether protected fields hold values.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","package","parse-server","self-hosted"],"not_affected_if":["default-config","no-write-only-access"],"how_to_check":null,"fix":"- Parse Server `8.6.116` (8.x line)\n- Parse Server `9.10.7-alpha.2` (9.x alpha line)","status":"open","published_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:51:05+00:00","updated_at":"2026-11-08T14:51:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:51:05Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server `8.6.116` (8.x line)\n- Parse Server `9.10.7-alpha.2` (9.x alpha line)","reach":"network","title":"Parse Server: create and update responses leak whether protected fields are set","impact":"low","summary":"Parse Server 8.6.109 to before 8.6.116 and 9.10.6-alpha.1 to before 9.10.7-alpha.2 mark fields as deleted in create or update responses based on stored values the caller cannot read. An attacker with write-only access to an object can read those markers to infer whether protected fields hold values.","audience":"developers","category":"package","nicknames":[],"who_cares":["parse-server","node","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker infers whether protected fields contain values","analyst_note":"","how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` in the project that runs it.\n- Look for versions `8.6.109` through `8.6.115`, or `9.10.6-alpha.1` through `9.10.7-alpha.1`, as affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-write-only-access"],"who_is_affected":"Teams that run Parse Server with object-level permissions where some users can write to objects but not read certain protected fields. Exposure depends on the data model and how protected fields are used; deployments without write-only access patterns have little to leak.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000748,"input_tokens":4632,"output_tokens":569,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-124425':15A,18A '-2026':14A,17A '8.6.109':29B,80C '8.6.116':32B,82C '9.10.6':34B,84C '9.10.7':38B,87C 'access':63B,118C 'alpha.1':35B,85C 'alpha.2':39B,88C 'attack':58B,112C 'base':49B,104C 'caller':54B,109C 'cannot':55B,110C 'contain':89C 'creat':3A,45B,96C 'cve':13A,16A 'delet':43B,103C 'disclosur':92C 'field':10A,41B,75B,101C,130C 'hold':76B 'host':26B 'infer':72B,127C 'inform':91C 'inspect':123C 'leak':7A 'mark':40B,100C 'marker':70B,125C 'node':19B 'object':66B,121C 'packag':20B 'pars':1A,22B,27B,78C 'parse-serv':21B 'protect':9A,74B,129C 'read':56B,68B,111C,117C 'respons':6A,48B,99C 'self':25B 'self-host':24B 'server':2A,23B,28B,79C 'set':12A,132C 'store':51B,106C 'updat':5A,47B,98C 'valu':52B,77B,107C 'vulner':93C 'whether':8A,73B,128C 'write':61B,114C 'write-on':60B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Parse Server with object-level permissions where some users can write to objects but not read certain protected fields. Exposure depends on the data model and how protected fields are used; deployments without write-only access patterns have little to leak.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","node","package","parseserver","selfhosted"],"campaign_type":null,"search_a":"'-124425':15A,18A '-2026':14A,17A 'creat':3A 'cve':13A,16A 'field':10A 'leak':7A 'pars':1A 'protect':9A 'respons':6A 'server':2A 'set':12A 'updat':5A 'whether':8A","search_b":"'8.6.109':29B '8.6.116':32B '9.10.6':34B '9.10.7':38B 'access':63B 'alpha.1':35B 'alpha.2':39B 'attack':58B 'base':49B 'caller':54B 'cannot':55B 'creat':45B 'delet':43B 'field':41B,75B 'hold':76B 'host':26B 'infer':72B 'mark':40B 'marker':70B 'node':19B 'object':66B 'packag':20B 'pars':22B,27B 'parse-serv':21B 'protect':74B 'read':56B,68B 'respons':48B 'self':25B 'self-host':24B 'server':23B,28B 'store':51B 'updat':47B 'valu':52B,77B 'whether':73B 'write':61B 'write-on':60B","search_c":"'8.6.109':80C '8.6.116':82C '9.10.6':84C '9.10.7':87C 'access':118C 'alpha.1':85C 'alpha.2':88C 'attack':112C 'base':104C 'caller':109C 'cannot':110C 'contain':89C 'creat':96C 'delet':103C 'disclosur':92C 'field':101C,130C 'infer':127C 'inform':91C 'inspect':123C 'mark':100C 'marker':125C 'object':121C 'pars':78C 'protect':129C 'read':111C,117C 'respons':99C 'server':79C 'set':132C 'store':106C 'updat':98C 'valu':107C 'vulner':93C 'whether':128C 'write':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T14:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124425","severity":null,"published_at":"2026-11-08T14:18:08+00:00","modified_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102034,"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-ch64-8phh-m7hc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T14:17:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102035,"url":"https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.7-alpha.2-information-disclosure-via-save-response","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}