GHSA-9cq8-mq5q-gphmLowCVSS 3.1
Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create...
🔗 CVE IDs covered (1)
📋 Description
Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.
🔗 References (4)
- https://github.com/parse-community/parse-server/security/advisories/GHSA-qq3r-ppqq-rh6m
- https://nvd.nist.gov/vuln/detail/CVE-2026-122301
- https://www.vulncheck.com/advisories/parse-server-before-8.6.114-and-9.0.0-before-9.10.6-alpha.6-information-disclosure-via-object-create-response
- https://github.com/advisories/GHSA-9cq8-mq5q-gphm