{"id":"CVE-2026-122301","title":"Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response","summary":"Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with crea…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-200"],"vendor":"parse-community","product":"parse-server","affected":["parse-server >= 9.0.0 < 9.10.6-alpha.6","parse-server < 8.6.114"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:25:07.021Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122301","references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-qq3r-ppqq-rh6m","label":"GitHub Security Advisory (GHSA-qq3r-ppqq-rh6m)"},{"url":"https://www.vulncheck.com/advisories/parse-server-before-8.6.114-and-9.0.0-before-9.10.6-alpha.6-information-disclosure-via-object-create-response","label":"VulnCheck Advisory: Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.683Z","epss":0.00206,"epssPercentile":0.10719,"slug":"CVE-2026-122301","body":"## Overview\n\nParse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.\n\n## Affected\n\n- `parse-server >= 9.0.0 < 9.10.6-alpha.6`\n- `parse-server < 8.6.114`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}