{"id":"CVE-2026-119571","aliases":[],"cve":{"records":[{"id":"CVE-2026-119571","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T10:56:15.488Z","published":"2026-10-30T13:18:10.885Z","modified":"2026-10-30T13:18:10.885Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T13:18:10.885Z"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-8j8q-73xx-w3m4","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/parse-server-9.7.0-before-9.10.5-alpha.10-installation-update-misdirection-via-installation-id","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-639","description":"Authorization Bypass Through User-Controlled Key","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*","versionStartIncluding":"9.7.0","versionEndExcluding":"9.10.5-alpha.10"}]}]}]}],"prioritization":[]},"title":"Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.","score":6.3,"severity":"medium","published":"2026-10-30T13:18:10.885Z","modified":"2026-10-30T13:18:10.885Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"parse-community","name":"parse-server","platforms":[],"versions":[{"version":"9.7.0","status":"affected","lessThan":"9.10.5-alpha.10","versionType":"semver"},{"version":"9.10.5-alpha.10","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/parse-server","packageIdentity":{"ecosystem":"npm","name":"parse-server"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119571"}],"remediation":[],"references":["https://github.com/parse-community/parse-server/security/advisories/GHSA-8j8q-73xx-w3m4","https://www.vulncheck.com/advisories/parse-server-9.7.0-before-9.10.5-alpha.10-installation-update-misdirection-via-installation-id"],"sources":[{"name":"CVE","id":"CVE-2026-119571","modified":"2026-10-30T13:18:10.885Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119571"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7}],"sourceAffected":[],"observedAt":"2026-10-30T14:52:59.508Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T05:35:31.277Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T15:30:34.371Z","attemptedAt":"2026-10-30T15:30:34.371Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T15:30:34.521Z","attemptedAt":"2026-10-30T15:30:34.521Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T15:30:34.454Z","attemptedAt":"2026-10-30T15:30:34.454Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T15:30:33.161Z","attemptedAt":"2026-10-30T15:30:33.161Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119571","modified":"2026-10-30T14:16:46.023","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T15:30:34.371Z"},{"source":"NVD","id":"CVE-2026-119571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119571","modified":"2026-10-30T14:16:46.023","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-30T15:30:34.371Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113925","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113925","modified":"Oct 30, 2026, 1:18:10 PM","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T15:30:34.454Z"}],"aiSummary":{"text":"Parse Server versions 9.7.0 before 9.10.5-alpha.10 contain an authorization flaw, allowing attackers with knowledge of another installation's object ID to update protected fields. The weakness occurs when protectedFieldsTriggerExempt is enabled. Attackers must have access to the installation ID.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T15:06:08.719Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119571"}]}}