CVE-2026-120310 parse-community CVE debrief

Who should care

Defenders responsible for Parse Server instances, particularly those with class-level permissions or object ACLs allowing update but not read access, should assess exposure and prioritize updates to prevent potential information disclosure.

Why it matters

CVE-2026-120310 is a low-severity vulnerability affecting Parse Server instances, allowing potential information disclosure via object update responses. Defenders should prioritize verifying and updating vulnerable instances to prevent this issue.

• Potential information disclosure via object update responses for clients with update but not read permissions
• Verification of class-level permissions and object ACLs to ensure proper access control
• Update vulnerable Parse Server instances to prevent potential information disclosure

Technical summary

The vulnerability affects Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1, allowing clients with update but not read permissions to see object data in update responses. This could lead to potential information disclosure via object update responses. The vulnerability has a CVSS score of 2.3 and a LOW severity rating. Defenders should prioritize verifying and updating Parse Server instances to prevent potential information disclosure via object update responses. The CVE record and NVD entry provide limited information about the vulnerability.

Defensive priority

Defenders should prioritize verifying and updating Parse Server instances to prevent potential information disclosure via object update responses.

Recommended defensive actions

• Verify Parse Server instances for version 8.6.109 or later and 9.10.6-alpha.1 or later
• Update vulnerable Parse Server instances to prevent potential information disclosure
• Review class-level permissions and object ACLs to ensure proper access control
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with a CVSS score of 2.3 and a LOW severity rating. The vulnerability affects Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.