CVE-2026-124425

Name of the Vulnerable Software and Affected Versions Parse Server versions 8.6.109 through 8.6.115 Parse Server versions 9.10.6-alpha.1 through 9.10.7-alpha.1

Description An information disclosure issue exists where create or update responses mark fields as deleted based on stored values that the caller is not authorized to read. This allows attackers who possess write access but lack read access to an object to inspect these markers and infer the existence of protected fields.

Recommendations Update Parse Server to version 8.6.116. Update Parse Server to version 9.10.7-alpha.2.