# CVE-2026-120310: Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- parse-community / parse-server (parse-server): ≥ 9.0.0; < 9.10.6-alpha.1 (affected, semver); 9.10.6-alpha.1 (unaffected, semver). Source: CNA: VulnCheck
- parse-community / parse-server (parse-server): ≥ 0; < 8.6.109 (affected, semver); 8.6.109 (unaffected, semver). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: VulnCheck

- CVSS 3.1: 3.1 (low); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-200

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-2rcp-jc67-vq74 (CNA: VulnCheck; vendor-advisory)

- https://www.vulncheck.com/advisories/parse-server-before-8.6.109-and-9.0.0-before-9.10.6-alpha.1-information-disclosure-via-object-update-response (CNA: VulnCheck; third-party-advisory)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2026-120310; retrieved 2026-11-02; source updated 2026-11-02

Revision: c97b18ed73859a83cd8dd9a5ddbde66acdae059fb41569777f4e6564f9f4dc72

Canonical: https://y2.dev/cve/CVE-2026-120310