{"affected":[{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"parse-server","product":"parse-server","source":"CNA: VulnCheck","vendor":"parse-community","versions":[{"lessThan":"9.10.6-alpha.6","status":"affected","version":"9.0.0","versionType":"semver"},{"status":"unaffected","version":"9.10.6-alpha.6","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"parse-server","product":"parse-server","source":"CNA: VulnCheck","vendor":"parse-community","versions":[{"lessThan":"8.6.114","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.6.114","versionType":"semver"}]}],"cveId":"CVE-2026-122301","cwes":["CWE-200"],"description":"Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":3.1,"severity":"low","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793845507021,"publishedAt":1793845507021,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qq3r-ppqq-rh6m"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/parse-server-before-8.6.114-and-9.0.0-before-9.10.6-alpha.6-information-disclosure-via-object-create-response"}],"remediation":[],"revision":"a9aa3cdd0456c6345295865a64d0707fbb6758eebe54da376ba57392987583bd","sources":[{"modifiedAt":1793845507021,"name":"CNA: VulnCheck","retrievedAt":1793848149732,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122301"}],"ssvc":null,"status":"published","title":"Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response","updatedAt":1793848149732}