Low severity3.1NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026

CVE-2026-124425

Description

Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Parse Community/Parse Serverllm-fuzzy
Range: <8.6.116, <9.10.7-alpha.2

Patches

Vulnerability mechanics

References

github.com/parse-community/parse-server/security/advisories/GHSA-ch64-8phh-m7hcnvd
www.vulncheck.com/advisories/parse-server-9.10.6-alpha.1-before-9.10.7-alpha.2-information-disclosure-via-save-responsenvd

News mentions

No linked articles in our index yet.

cvss	0.202
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000