Executive brief
Parse Server is an open-source backend that manages data and authentication for applications. LiveQuery is a real-time subscription feature that pushes data changes to connected clients. The vulnerability allows authenticated users to receive sensitive field values through LiveQuery that the REST API correctly hides from them, potentially exposing private or restricted information meant to be hidden by role-based access controls.
Technical details
LiveQuery evaluates protectedFields permissions against an incompletely resolved subscriber identity, failing to apply field masks defined for roles, authenticated users, or specific users. When a subscription lacks its own session token, the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. An authenticated subscriber can exploit this to receive masked field values and use them to filter or watch subscriptions, bypassing intended access controls on role-scoped, authenticated, or per-user field groups.
Affected products
- Parse Community Parse Server versions >= 9.0.0 and < 9.10.1-alpha.8, and versions < 8.6.89
Timeline
- 2026-09-26: disclosed: Published by Parse Community