Is CVE-2026-116161 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116161 being exploited in the wild.

How severe is CVE-2026-116161?

Informational severity, published 25 October 2026.

Which products and versions are affected?

Parse Community Parse Server 8.6.102 and earlier; 9.0.0 to 9.10.5-alpha.3.

How is CVE-2026-116161 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116161?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116161: Parse Server information disclosure in LiveQuery $or subscriptions

CVE-2026-116161 · Severity: info · Published 2026-10-25

Parse Server is a backend service used to build applications with real-time data synchronization. The LiveQuery feature has a vulnerability where authenticated users subscribing to real-time data with certain query patterns can receive other users' events, including session tokens that could allow account takeover or impersonation of other users.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-116161 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116161 being exploited in the wild.
How severe is CVE-2026-116161?: Informational severity, published 25 October 2026.
Which products and versions are affected?: Parse Community Parse Server 8.6.102 and earlier; 9.0.0 to 9.10.5-alpha.3.
Is there a fix for CVE-2026-116161?: Yes: fixed in Parse Server 8.6.103, 9.10.5-alpha.4. Until then: Protect sensitive classes with ACL or class-level permissions rather than relying solely on query constraints for isolation. Avoid subscribing to the _Session class with $or queries, and more generally avoid $or in subscription queries where isolation depends only on constraints placed next to the $or operator. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116161 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116161?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.103, 9.10.5-alpha.4

Protect sensitive classes with ACL or class-level permissions rather than relying solely on query constraints for isolation. Avoid subscribing to the _Session class with $or queries, and more generally avoid $or in subscription queries where isolation depends only on constraints placed next to the $or operator.

Technical details

Parse Server's LiveQuery groups subscriptions by a hash of the query that omits constraints adjacent to $or operators, including server-added isolation filters on _Session subscriptions and beforeSubscribe trigger constraints. Authenticated attackers can exploit this via $or queries to receive events meant for other clients, potentially exposing session tokens enabling account impersonation. The fix derives the subscription hash from the complete query including all constraints.

Affected products

Parse Community Parse Server 8.6.102 and earlier; 9.0.0 to 9.10.5-alpha.3

Timeline

2026-10-10: disclosed
2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.