CVE-2026-119571

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.7.0 through 9.10.5-alpha.9

Description An authorization flaw exists where Installation updates addressed by object ID are applied to the installation specified in the X-Parse-Installation-Id header. If the protectedFieldsTriggerExempt setting is enabled, an attacker who knows the object ID of another installation can force a beforeSave() trigger to process the protected fields of that installation during a write operation elsewhere.

Recommendations Update Parse Server to version 9.10.5-alpha.10 or later. Disable the protectedFieldsTriggerExempt setting to prevent the unauthorized processing of protected fields.