Stored Field Exposure in Parse Server Update Responses

Executive Summary

CVE-2026-120310 is an information disclosure vulnerability in Parse Server. It affects versions >= 9.0.0 and < 9.10.6-alpha.1, as well as versions >= 8.6.109. The issue occurs when an object update operation returns stored field values to a caller who lacks read access to the object. This happens if class-level permissions allow updates but not reads, or if an object ACL grants write access without read permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review Parse Server logs for unauthorized access attempts where update operations return stored field values to clients without read permissions. Check if clients with update-only permissions receive sensitive data in responses. No specific commands are provided in the resources, but monitoring update responses for unexpected field values may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

Attackers with update privileges but no read access can receive sensitive data in update responses. This includes results of atomic operations (Increment, Add, AddUnique, Remove), Cloud Code trigger values, and parent field data in certain cases. The exploit requires network access and low privileges but no user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Parse Server to versions 9.10.6-alpha.1 or 8.6.109 or later. Avoid granting update permissions to clients that should not have read access to object data. Review and adjust class-level permissions and object ACLs to ensure no client has update privileges without corresponding read access.

Useful 0 Not Useful 0