Parse Server Information Disclosure via Deleted Field Markers

Executive Summary

CVE-2026-124425 is an information disclosure vulnerability in Parse Server versions 8.6.109 to 8.6.115 and 9.10.6-alpha.1 to 9.10.7-alpha.1. It allows attackers with write but not read access to infer whether protected fields are set by inspecting markers in create or update responses that indicate deleted fields based on stored values they cannot read.

Useful 0 Not Useful 0

Detection Guidance

Check if your parse-server version is within the vulnerable range (>= 8.6.109 and < 8.6.116 or >= 9.10.6-alpha.1 and < 9.10.7-alpha.2). Use commands like 'npm list parse-server' or 'npm view parse-server version' to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users with write access to infer sensitive information about protected fields in objects they cannot read. While the impact is limited due to low severity, it may lead to unintended data exposure if attackers can deduce the presence of sensitive fields.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized information disclosure. Attackers with write but not read access can infer the presence of protected fields, which may include sensitive personal or health data. This information leakage violates principles of least privilege and data confidentiality required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade parse-server to version 8.6.116 or later, or 9.10.7-alpha.2 or later to patch the vulnerability.
• Avoid granting write access to objects or classes that clients cannot read to prevent information leakage.
• Perform writes via Cloud Code using the master key and only return client-accessible values.

Useful 0 Not Useful 0