CVE-2026-119125 - Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled.
LOW
Severity & confidence
Source severitylow
Platform severitylow
Confidencehigh
Exploitationunknown
CVSS3.1
Affected
Reporting sources (1)
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-29T16:18:05
Last updated2026-11-01T16:14:23
Ingested2026-10-31T17:27:43
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
No recommended action published with this item - review the original source.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: standards ยท Original: NIST NVD - National Vulnerability Database
