CVE-2026-119126: Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.106 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.5-alpha.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A client that already has write access can exploit it. The attack is relevant where afterSave triggers or LiveQuery events are relied on for audit logging, notifications, or derived-data updates.
What does an attacker need to send?
The attacker needs to perform a write using dot-notation keys with null or undefined values. The write is stored even though the server returns an error.
How can I tell whether an attempted bypass occurred?
Look for writes that were persisted despite returning an error, particularly requests containing dot-notation keys with null or undefined values. Such writes may have no corresponding afterSave-trigger execution or LiveQuery event.
Which releases are affected?
Affected releases are Parse Server versions before 8.6.106 and versions from 9.0.0 before 9.10.5-alpha.7.