Parse Server versions before 8.6.109 and before 9.10.6-alpha.1 expose stored field values in object update responses without verifying read permissions. This flaw allows users who have update rights but lack read rights to retrieve confidential object data. The attacker can harvest results of atomic operations, Cloud Code trigger-set values, and, under certain dot notation conditions, entire stored parent fields, thereby compromising data confidentiality.

The vulnerability impacts the Parse Platform Parse Server component. Developers using Parse Server version 8.x.x before 8.6.109 or 9.x.x before 9.10.6-alpha.1 are susceptible. The affected product is documented as parse-community:parse-server within the vendor’s ecosystem, and the CPE identifies the parse-server package in these releases.

The CVSS score of 2.3 indicates a low severity flaw, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the Parse Server REST/GraphQL API; an attacker can craft update requests to trigger the disclosure. Exploitation requires the attacker to have update access to a target class or object; if such permissions are granted, the data leak can readily occur without additional credentials or network traversal.