CVE-2026-119570— Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses

Quick assessment

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Parse Server 版本从 9.7.0 到 9.10.5-alpha.7（不含）存在信息泄露漏洞。该漏洞允许客户端通过触发器使用点表示法（dot notation）键写入受保护字段的值，并获取这些值。当配置为时，拥有创建或更新权限的客户端能够在同一请求中读取触发器在受保护字段下写入的值。

CVSS 3.1 · Low Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses

Source: CVE Program / CVE List V5

Vulnerability Description

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
parse-community	parse-server	9.7.0 ~ 9.10.5-alpha.7	-

II. Public POCs for CVE-2026-119570

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119570

请登录查看更多情报信息。

Other References for CVE-2026-119570 (2)

https://github.com/parse-community/parse-server/security/advisories/GHSA-6mfr-rv66-x7m3 vendor-advisory
https://www.vulncheck.com/advisories/parse-server-9.7.0-before-9.10.5-alpha.7-protected-field-exposure-in-save-responses third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119570

Same Patch Batch · parse-community · 2026-10-30 · 3 CVEs total

CVE-2026-119569	5.3 MEDIUM	Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
CVE-2026-119571	3.7 LOW	Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installatio

IV. Related Vulnerabilities

Same product: parse-server

Same vendor: parse-community

Same weakness: CWE-200