CVE-2026-122301 Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response

Low 2.3 Published 5 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-122301?

CVE-2026-122301 is a low-severity vulnerability in parse-community parse-server, published on 5 Nov 2026.

Official description

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.

Weakness: CWE-200

Which versions are affected by CVE-2026-122301?

How do I fix CVE-2026-122301?

No fix has been published for CVE-2026-122301 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122301 being exploited?

There is no known exploitation of CVE-2026-122301 in the wild and no public exploit code.

Sources

Also known as GHSA-9cq8-mq5q-gphm, GHSA-qq3r-ppqq-rh6m.