CVE-2026-119126

    Dashboard / Vulnerabilities / CVE-2026-119126

    CVE-2026-119126

    Published: 29 Oct 2026Last Modified: 31 Oct 2026

    Summary: Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

    Details: Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119126.json, https://github.com/parse-community/parse-server/security/advisories/GHSA-969q-274f-mc7w, https://nvd.nist.gov/vuln/detail/CVE-2026-119126, https://www.vulncheck.com/advisories/parse-server-before-8.6.106-and-9.0.0-before-9.10.5-alpha.7-aftersave-trigger-and-livequery-bypass-via-dot-notation-keys

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 532a461d30a6ed4457839f2caf5f30d5abf51a55
    Fixed -280b9c41e7172f290cdb52bdb9fe29a7db77e09e

    Affected versions

    9.10.4
    9.10.5-alpha.6
    9.10.5-alpha.5
    9.10.5-alpha.4
    9.10.5-alpha.3
    9.10.5-alpha.2
    9.10.5-alpha.1
    9.10.3
    9.10.2
    9.10.1
    9.10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119126 | CVE-DB