Parse Server returns field values in object create responses to callers that lack read permission to the created object through class-level permissions or ACLs. An attacker with create permission can read values set by Cloud Code triggers, schema defaults, and the class default ACL. This results in expose of potentially sensitive data that should not be visible to the attacker.

Vulnerable releases include Parse Server 8.x prior to 8.6.114 and 9.x prior to 9.10.6-alpha.6. These versions run under the parse-community project and are found under the parse-platform Parse Server package. Anyone running a pre‑release or default build of these major branches is affected.

The publicly available CVSS score is 2.3, indicating a low severity issue, and the EPSS score is not available. Because the flaw requires only create permission—privilege that can be granted to many users—an attacker can easily discover exploitable classes by creating objects. Although the likelihood of exploitation is not high, the lack of read restriction means any object creation can leak data that an attacker should not see. The vulnerability is not listed in the CISA KEV catalog.