---
id: CVE-2026-119126
title: >-
  Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger
  and LiveQuery Bypass via Dot Notation Keys
summary: >-
  Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot
  notation keys with null or undefined values when building the saved object, so
  a write is stored but returns an error and skips afterSave triggers and
  LiveQuery e…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-754
vendor: parse-community
product: parse-server
affected:
  - parse-server >= 9.0.0 < 9.10.5-alpha.7
  - parse-server < 8.6.106
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T20:15:13.864924Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T20:15:26.949Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119126'
references:
  - url: >-
      https://github.com/parse-community/parse-server/security/advisories/GHSA-969q-274f-mc7w
    label: GitHub Security Advisory (GHSA-969q-274f-mc7w)
  - url: >-
      https://www.vulncheck.com/advisories/parse-server-before-8.6.106-and-9.0.0-before-9.10.5-alpha.7-aftersave-trigger-and-livequery-bypass-via-dot-notation-keys
    label: >-
      VulnCheck Advisory: Parse Server before 8.6.106 and 9.0.0 before
      9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation
      Keys
tags:
  - cve.org
epss: 0.00264
epssPercentile: 0.18361
ingestedAt: '2026-11-02T21:30:04.848Z'
---

## Overview

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.

## Affected

- `parse-server >= 9.0.0 < 9.10.5-alpha.7`
- `parse-server < 8.6.106`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.