CVE-2026-122301

EUVD-2026-117212
Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.73%
Common Weakness Enumeration
References
https://github.com/parse-community/parse-server/security/advisories/GHSA-qq3r-ppqq-rh6m
https://www.vulncheck.com/advisories/parse-server-before-8.6.114-and-9.0.0-before-9.10.6-alpha.6-information-disclosure-via-object-create-response