# CVE-2026-116161: Parse Server information disclosure in LiveQuery $or subscriptions

Source: https://junglewise.ai/threats/cve-2026-116161-parse-server-before-8-6-103-and-9-0-0-before-9-10-5-alpha-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116161 · Severity: info · Published 2026-10-25

Parse Server is a backend service used to build applications with real-time data synchronization. The LiveQuery feature has a vulnerability where authenticated users subscribing to real-time data with certain query patterns can receive other users' events, including session tokens that could allow account takeover or impersonation of other users.

Technologies: [Parse Community Parse Server](https://junglewise.ai/threats/technologies/parse-community-parse-server). Vendors: [Parse Community](https://junglewise.ai/threats/vendors/parse-community).

## Quick answers

**Is CVE-2026-116161 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116161 being exploited in the wild.

**How severe is CVE-2026-116161?** Informational severity, published 25 October 2026.

**Which products and versions are affected?** Parse Community Parse Server 8.6.102 and earlier; 9.0.0 to 9.10.5-alpha.3.

**Is there a fix for CVE-2026-116161?** Yes: fixed in Parse Server 8.6.103, 9.10.5-alpha.4. Until then: Protect sensitive classes with ACL or class-level permissions rather than relying solely on query constraints for isolation. Avoid subscribing to the _Session class with $or queries, and more generally avoid $or in subscription queries where isolation depends only on constraints placed next to the $or operator. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116161 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116161?** Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Parse Server 8.6.103, 9.10.5-alpha.4

Protect sensitive classes with ACL or class-level permissions rather than relying solely on query constraints for isolation. Avoid subscribing to the _Session class with $or queries, and more generally avoid $or in subscription queries where isolation depends only on constraints placed next to the $or operator.

## Technical details

Parse Server's LiveQuery groups subscriptions by a hash of the query that omits constraints adjacent to $or operators, including server-added isolation filters on _Session subscriptions and beforeSubscribe trigger constraints. Authenticated attackers can exploit this via $or queries to receive events meant for other clients, potentially exposing session tokens enabling account impersonation. The fix derives the subscription hash from the complete query including all constraints.

## Affected products

- Parse Community Parse Server 8.6.102 and earlier; 9.0.0 to 9.10.5-alpha.3

## Timeline

- 2026-10-10: disclosed
- 2026-10-25: advisory

## References

- [https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp](https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp)
- [https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.4-livequery-information-disclosure-via-or-subscriptions](https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.4-livequery-information-disclosure-via-or-subscriptions)

## Related threats

- [Parse Server email validation regex denial of service](https://junglewise.ai/threats/cve-2026-123487-parse-server-before-8-6-115-and-9-0-0-before-9-10-7-alpha-1)
- [Parse Server prototype pollution in Cloud Code and LiveQuery](https://junglewise.ai/threats/cve-2026-121965-parse-server-before-8-6-113-and-9-0-0-before-9-10-6-alpha-5)
- [Parse Server denial of service via dot notation object update](https://junglewise.ai/threats/cve-2026-121414-parse-server-before-8-6-110-and-9-0-0-before-9-10-6-alpha-2)
- [Parse Server prototype pollution denial of service](https://junglewise.ai/threats/cve-2026-119569-parse-server-before-8-6-108-and-9-0-0-before-9-10-5-alpha-9)
- [Parse Server $relatedTo query ACL bypass](https://junglewise.ai/threats/cve-2026-116801-parse-server-before-8-6-105-and-9-0-0-before-9-10-5-alpha-6-does)