---
id: CVE-2026-119570
title: >-
  Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save
  Responses
summary: >-
  Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information
  disclosure vulnerability that allows clients to receive protected field values
  written by beforeSave triggers using dot notation keys. When
  protectedFieldsSaveResponse…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: parse-community
product: parse-server
affected:
  - parse-server >= 9.7.0 < 9.10.5-alpha.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:17:36.434809Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:17:47.332Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119570'
references:
  - url: >-
      https://github.com/parse-community/parse-server/security/advisories/GHSA-6mfr-rv66-x7m3
    label: GitHub Security Advisory (GHSA-6mfr-rv66-x7m3)
  - url: >-
      https://www.vulncheck.com/advisories/parse-server-9.7.0-before-9.10.5-alpha.7-protected-field-exposure-in-save-responses
    label: >-
      VulnCheck Advisory: Parse Server 9.7.0 before 9.10.5-alpha.7 Protected
      Field Exposure in Save Responses
tags:
  - cve.org
epss: 0.00252
epssPercentile: 0.16745
ingestedAt: '2026-11-05T16:07:30.399Z'
---

## Overview

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.

## Affected

- `parse-server >= 9.7.0 < 9.10.5-alpha.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.