CVE-2026-122301
Last modified
CVE-2026-122301 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL..
Description
Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| parse-community | parse-server | >= 9.0.0, < 9.10.6-alpha.6 |
| parse-community | parse-server | < 8.6.114 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-122301?
How severe is CVE-2026-122301?
How do I fix CVE-2026-122301?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-122266Improper isolation of shared resources in aws-network-policy…8.7
- CVE-2026-12227The Visual Composer Website Builder plugin for WordPress is …9.8
- CVE-2026-12228A stored cross-site scripting (XSS) vulnerability exists in …5.4
- CVE-2026-122299Dulwich before 1.2.20 contains a commit object parsing vulne…8.8
- CVE-2026-1223PrismX MX100 AP controller developed by BROWAN COMMUNICATION…6.9
- CVE-2026-12230The LearnPress – WordPress LMS Plugin for Create and Sell On…6.4
- CVE-2026-122302Kyverno before 1.19.2 contains a privilege escalation vulner…9.8
- CVE-2026-122303Kyverno from 1.17.0 before 1.19.2 contains an authorization …9.9
- CVE-2026-122304Kyverno from 1.17.0 before 1.19.2 contains an authorization …9.9
- CVE-2026-122305Kyverno before 1.19.2 contains a denial of service vulnerabi…7.7
- CVE-2026-122306Kyverno before 1.19.2 contains a denial of service vulnerabi…7.7
- CVE-2026-122307Kyverno before 1.19.2 contains a policy bypass vulnerability…7.7
Are you affected by CVE-2026-122301?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST