Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119571— Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID

Quick assessment

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 9.7.0 至 9.10.5-alpha.10（不含）之间的 Parse Server 存在一个授权缺陷：当通过对象 ID 对集合执行更新时，系统会将更新错误地应用到请求头中指定的安装上。若启用了配置，攻击者在知晓其他安装的对象 ID 的情况下，可在向其他位置写入数据时，触发钩子以处理该其他安装的保护字段，从而绕过字段保护机制。

CVSS 3.7 · Low Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1548.001 · Setuid and Setgid

Affected Version Matrix 2

Vendor	Product	Version Range	Status
parse-community	parse-server	`9.7.0< 9.10.5-alpha.10`	affected
		`9.10.5-alpha.10`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID

Source: CVE Program / CVE List V5

Vulnerability Description

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
parse-community	parse-server	9.7.0 ~ 9.10.5-alpha.10	-

II. Public POCs for CVE-2026-119571

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119571

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-119571 (2)

https://www.cve.org/CVERecord?id=CVE-2026-119571

Same Patch Batch · parse-community · 2026-10-30 · 3 CVEs total

CVE-2026-119569	5.3 MEDIUM	Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
CVE-2026-119570	3.1 LOW	Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses

IV. Related Vulnerabilities

Same product: parse-server

Same vendor: parse-community

Same weakness: CWE-639