low3.7
CVE-2026-119571
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation nam…
Impact
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
Affected products
| Product | Affected versions |
|---|---|
| Parse Server From 9.7.0 | before 9.10.5-alpha.10 |
Versions were read from the advisory text. No structured product data has been published for this record yet.