CVE-2026-122301

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.114 Parse Server versions 9.0.0 through 9.10.6-alpha.5

Description An issue exists where the server returns field values in object create responses to users who do not have read access to the created object via class-level permissions or the object's Access Control List (ACL). A user with create permissions can exploit this to obtain values established by schema defaults, the class default ACL, or Cloud Code triggers.

Recommendations Update Parse Server to version 8.6.114 or later. Update Parse Server to version 9.10.6-alpha.6 or later.