The vulnerability in Parse Server 9.7.0 through 9.10.5-alpha.6 allows a client with create or update permissions to read protected field values that were written by beforeSave triggers. By using dot notation keys the server returns values located beneath a protected field in the save response, resulting in disclosure of sensitive data that should be hidden and violating confidentiality.

The affected product is Parse Server from the Parse Community. Versions from 9.7.0 up to, but not including, 9.10.5-alpha.7 contain the flaw. The issue is present in all deployments of those releases regardless of host OS or environment.

The CVSS score is 2.3, indicating low overall impact. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited exploitation activity. However, any client able to perform create or update operations with the relevant permissions can trigger the disclosure by sending a specially crafted request that includes dot notation keys. The attacker does not need elevated privileges beyond those normally granted for data modification.