CVE-2026-119571
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Parse Server via Installation ID

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119571
EUVD
EUVD-2026-113925

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
parse-community parse-server 9.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server versions 9.7.0 to 9.10.5-alpha.10. It involves an authorization flaw where installation update requests are incorrectly applied to the installation specified by the X-Parse-Installation-Id header instead of the installation addressed by its object ID. This only occurs when the protectedFieldsTriggerExempt option is enabled and a beforeSave trigger is used on the installation class.

Detection Guidance

Check Parse Server version with 'npm list parse-server' or 'grep parse-server package.json'. Verify if protectedFieldsTriggerExempt is enabled in configuration. Monitor logs for beforeSave triggers on installation class with mismatched X-Parse-Installation-Id headers.

Impact Analysis

An attacker knowing another installation's object ID could exploit this to trigger processing of unauthorized data, potentially exposing sensitive fields. This could lead to unauthorized access to protected information if the beforeSave trigger processes sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (protected health information). Unauthorized exposure of protected fields could result in regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Upgrade to Parse Server 9.10.5-alpha.10 or later. Disable protectedFieldsTriggerExempt if not required. Review beforeSave triggers on installation class to ensure no sensitive data processing. Monitor for unauthorized installation updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart