CVE-2026-119125

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.107 Parse Server versions 9.0.0 through 9.10.5-alpha.7

Description An issue exists where the server returns the stored value of a field that was reverted by a beforeSave trigger during object update responses. This occurs even if the client lacks read access to the object or the specific field. An authenticated client can exploit this by updating an object where the beforeSave trigger reverts a field using revert() or a constant: true validator. This allows the client to read protected values, such as the raw MFA authData of their own account when protectedFieldsTriggerExempt is enabled.

Recommendations Update Parse Server to version 8.6.107 or later. Update Parse Server to version 9.10.5-alpha.8 or later.