low3.1
CVE-2026-119126
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a wri…
Impact
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.
Affected products
| Product | Affected versions |
|---|---|
| Parse Server | before 8.6.106 |
| 9.0.0 | before 9.10.5-alpha.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.