CVE-2026-119125 Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119125?
CVE-2026-119125 is a low-severity vulnerability in parse-community parse-server, published on 29 Oct 2026.
Official description
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled.
Weakness: CWE-200
Which versions are affected by CVE-2026-119125?
How do I fix CVE-2026-119125?
No fix has been published for CVE-2026-119125 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119125 being exploited?
There is no known exploitation of CVE-2026-119125 in the wild and no public exploit code.
Sources
Also known as GHSA-9rvr-f5hc-9f2f, GHSA-w9vv-f4q5-5fgr.