Low severity · published Oct 29, 2026
CVE-2026-119126
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
New
3.1
CVSS
–
EPSS
No
On KEV
Description
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parse-server · parse-community
9.0.0 before 9.10.5-alpha.7; before 8.6.106 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119126
vendor-advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-969q-274f-mc7w
third-party-advisory
https://www.vulncheck.com/advisories/parse-server-before-8.6.106-and-9.0.0-before-9.10.5-alpha.7-aftersave-trigger-and-livequery-bypass-via-dot-notation-keys
More from parse-server
10.0
CVE-2026-30966
Parse Server role escalation and CLP bypass via direct `_Join` table write
10.0
CVE-2024-27298
Parse Server literalizeRegexPart SQL Injection
9.8
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
9.8
CVE-2026-31871
Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
9.8
CVE-2026-31856
Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL