CVE-2026-122301

Parse Server versions prior to 8.6.114 and 9.0.0 prior to 9.10.6-alpha.6 are vulnerable to an Information Disclosure vulnerability via Object Create responses. The root cause is that the server returns field values to callers who lack read access to the created object based on class-level permiss...