CVE-2026-119570 Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses

Low 2.3 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119570?

CVE-2026-119570 is a low-severity vulnerability in parse-community parse-server, published on 30 Oct 2026.

Official description

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.

Weakness: CWE-200

Which versions are affected by CVE-2026-119570?

How do I fix CVE-2026-119570?

No fix has been published for CVE-2026-119570 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119570 being exploited?

There is no known exploitation of CVE-2026-119570 in the wild and no public exploit code.

Sources

Also known as GHSA-6mfr-rv66-x7m3, GHSA-9m35-gcx2-qx2g.