CVE-2026-124425: Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response
Published Nov 8, 2026
·Updated
Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 8.6.116 - Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 9.10.7-alpha.2
Event History
Nov 8, 2026
CVE Published
via MITRE·01:15 PM
Data Sourced
via MITRE·01:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:18 PM
DescriptionSeverityWeakness