---
id: "CVE-2026-124425"
page: "https://infrastack.ai/live/CVE-2026-124425"
kind: "vulnerability"
aliases: ["CVE-2026-124425"]
title: "Parse Server: create and update responses leak whether protected fields are set"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node", "package", "parse-server", "self-hosted"]
not_affected_if: ["default-config", "no-write-only-access"]
published_at: "2026-11-08T14:18:08+00:00"
first_seen_at: "2026-11-08T14:48:38+00:00"
updated_at: "2026-11-08T14:51:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124425", "first_seen_at": "2026-11-08T14:48:38+00:00"}]
exploit_sources: []
---

# Parse Server: create and update responses leak whether protected fields are set

Link for people: https://infrastack.ai/live/CVE-2026-124425 (this .md is for agents)

Parse Server 8.6.109 to before 8.6.116 and 9.10.6-alpha.1 to before 9.10.7-alpha.2 mark fields as deleted in create or update responses based on stored values the caller cannot read. An attacker with write-only access to an object can read those markers to infer whether protected fields hold values.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Parse Server `8.6.116` (8.x line)
- Parse Server `9.10.7-alpha.2` (9.x alpha line)

## Timeline

- 2026-11-08T14:48:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124425

## Documents

- [advisory] Vendor advisory: github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-ch64-8phh-m7hc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.7-alpha.2-information-disclosure-via-save-response

## From the sources

Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_