MEDIUM 6.3 NVD
CVE-2026-119571
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation name
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-8j8q-73xx-w3m4
- https://www.vulncheck.com/advisories/parse-server-9.7.0-before-9.10.5-alpha.10-installatio
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.