CVE-2026-119571 in Parse Server
Summary
by MITRE • 10/30/2026
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
Parse Server versions prior to 9.10.5-alpha.10 contain a critical authorization bypass vulnerability related to the handling of Installation objects and their associated triggers. The core issue stems from an inconsistency in how object identifiers are validated during update operations versus trigger execution contexts. Specifically, when a client initiates an update to an _Installation document using its unique objectId, Parse Server correctly restricts access based on that identifier. However, if the request also includes an X-Parse-Installation-Id header specifying a different installation identity, and the configuration option protectedFieldsTriggerExempt is enabled, the beforeSave trigger processes data as if it belongs to the installation identified in the header rather than the one targeted by the objectId update. This discrepancy creates a logic flaw where authentication checks applied during standard object modification are bypassed within the context of server-side triggers.
The technical mechanism relies on the separation between client-facing API validation and internal trigger execution pipelines. In normal operation, Parse Server ensures that users can only modify their own installation records by verifying the objectId against the authenticated session or token provided in the request headers. The protectedFieldsTriggerExempt setting is designed to allow certain sensitive fields within triggers to be accessible even when general field-level permissions would restrict them, typically for legitimate administrative purposes such as updating device tokens or last used timestamps without exposing other private data. However, due to this vulnerability, an attacker who knows the objectId of another user's installation can craft a request that updates a different object while simultaneously triggering logic intended for their own installation via the X-Parse-Installation-Id header. This allows the beforeSave trigger to read and process protected fields belonging to the victim’s installation, effectively leaking sensitive information or enabling unauthorized state changes under the guise of legitimate application logic.
The operational impact of this vulnerability is significant, particularly in applications that rely on Parse Server for mobile backend services where device-specific data such as push notification tokens, location history, or user preferences are stored within Installation objects. An attacker with knowledge of a target installation's objectId can exploit this flaw to exfiltrate protected field values through side-channel effects in the beforeSave trigger logic. Furthermore, if the application’s custom code performs write operations based on these processed fields without additional validation, it could lead to unauthorized modifications or privilege escalation within the application layer. This is especially dangerous because many developers assume that enabling protectedFieldsTriggerExempt provides a safe sandbox for handling sensitive data during automated processes, not realizing that the identity resolution mechanism contains this critical bypass when mixed with cross-object updates.
Mitigation strategies must address both immediate patching and architectural hardening. The primary remediation is to upgrade Parse Server to version 9.10.5-alpha.10 or later, where this authorization logic has been corrected to ensure that the identity used for trigger execution matches the object being modified unless explicitly allowed by stricter security configurations. In environments where upgrading is not immediately feasible, administrators should disable the protectedFieldsTriggerExempt setting if it is not strictly required for core functionality, thereby removing the attack vector entirely. Additionally, developers reviewing custom beforeSave triggers should implement explicit validation checks to ensure that any data processed within these functions corresponds accurately to the authenticated user’s context and does not rely solely on header-based identity assumptions when interacting with other objects.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized access to resources due to flawed authorization logic. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, specifically the aspect of using legitimate credentials or identifiers to bypass security controls, and potentially T1530 Data from Cloud Storage Object if sensitive data is exfiltrated via the trigger mechanism. Security teams should treat this as a high-severity issue requiring immediate attention due to its potential for silent data leakage and unauthorized state manipulation in widely deployed Parse Server instances.