PT-2026-133539

CVE-2026-119570

Published

2026-10-30

Updated

2026-10-30

Description by

CVSS 3.1

3.1

Low

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.7.0 through 9.10.5-alpha.6

Description An information disclosure issue exists where clients can receive protected field values written by beforeSave triggers using dot notation keys. This occurs when protectedFieldsSaveResponseExempt is set to false, allowing clients with create or update permissions to read values written by a trigger beneath a protected field within the same request.

Recommendations Update Parse Server to version 9.10.5-alpha.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Mtrezza

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers