Authorization Bypass Through User-Controlled Key Affecting parse-server package, versions >=9.7.0 <9.10.5-alpha.10
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Authorization Bypass Through User-Controlled Key vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-PARSESERVER-22132601
- published2 Nov 2026
- disclosed30 Oct 2026
- creditUnknown
Introduced: 30 Oct 2026
NewCVE-2026-119571 (opens in a new tab)How to fix?
Upgrade parse-server to version 9.10.5-alpha.10 or higher.
Overview
parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.
Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in RestWrite.prototype.handleInstallation in src/RestWrite.js when the protectedFieldsTriggerExempt option is enabled and a beforeSave trigger is registered on the installation class. When a client sends an installation update addressed by object ID, the function incorrectly resolves the target installation using the request's installation ID rather than the addressed object ID. As a result, the beforeSave trigger receives the full stored data of the addressed installation, including fields the requesting client is not permitted to read, while the write is applied to a different installation, allowing an attacker to read protected fields they are not authorized to access.
Note: This is only exploitable if the protectedFieldsTriggerExempt option is explicitly enabled (disabled by default) and a beforeSave trigger on the installation class is in use.