Parse Server CVE-2026-120310

Exploitation requires a specific permission mismatch: a client granted update capability via class-level permissions (update allowed but 'get'/read denied) OR an object ACL granting write but not read access. Given that, the update response discloses stored values - atomic-operation results (Increment, Add, AddUnique, Remove) and values set by Cloud Code triggers are returned reliably. Disclosure of the whole stored parent field additionally requires an update using a dot-notation key where the class has a beforeSave or afterSave trigger, or (on MongoDB) an operation on an array index. Limiting factors: the attacker must first be authenticated/authorized to update the object (PR:L); default configurations that do not grant update-without-read are not exposed; and the vendor notes the fix does NOT cover access rules in beforeFind/afterFind triggers, field-level protectedFields, or a plain object returned by an afterSave trigger. In batch requests with transaction:true, read access depending on requiresAuthentication, pointer permissions, system classes, or afterSave triggers is decided on pre-transaction state.

This is a low-severity information-disclosure issue (CVSS 4.0 base 2.3, CWE-200) and the signals are internally consistent: the vulnerability leaks data but has no integrity or availability impact (VI:N/VA:N) and causes no scope change. The attack vector is network (AV:N), but exploitation requires the attacker to already hold update/write permission on the target object (PR:L) that it does not also hold read permission for - a specific permission mismatch rather than open access. The vendor's own 4.0 vector sets AT:P, reflecting that the fuller disclosure (whole stored parent field) depends on particular conditions (dot-notation keys with beforeSave/afterSave triggers, or MongoDB array-index operations); the narrower leak of atomic-operation results and trigger-set values is more reliable. No EPSS score was supplied and the issue is NOT in CISA KEV; no public exploit code or PoC reference was provided. The vuln.today decision label is 'monitor' and the reporter is VulnCheck. Net assessment: a genuine confidentiality weakness but a real-world low priority - it requires a non-trivial misconfiguration (grant update-but-not-read), confidentiality impact is Low, and there is no evidence of exploitation or a weaponizable exploit. Treat as a patch-on-normal-cycle item, not an emergency. Note: because the supplied vector is CVSS 4.0 (not 3.1), the authenticated/unauthenticated determination here rests on PR:L in that 4.0 vector.

An application grants a mobile or web client class-level update permission (or a per-object ACL write grant) without the corresponding read/get permission, intending the client to blindly modify records it cannot view. The client issues an update that applies an atomic operation (e.g. Increment) or triggers Cloud Code that sets a value, and reads the resulting stored values back from the update response - data it was never meant to see. No public exploit code or PoC reference was identified at time of analysis.