Executive brief
Parse Server is a backend-as-a-service platform that uses class-level permissions (CLP) to control data access. A vulnerability allows unauthenticated clients to bypass these permissions and subscribe to real-time data streams in LiveQuery, exposing restricted data to unauthorized users without authentication or authorization checks.
Technical details
The vulnerability is an authorization bypass (CWE-863) in Parse Server's LiveQuery implementation. Class-level permissions are not enforced when clients subscribe to LiveQuery-enabled classes, allowing unauthenticated or unauthorized attackers to receive real-time events for all objects regardless of CLP restrictions. The attack is network-based, requires no authentication or user interaction, and has high confidentiality impact. Patches enforce CLP validation before subscription creation and during event delivery. Fixed in Parse Server 8.6.16 and 9.5.2-alpha.3.
Affected products
- Parse Community Parse Server All versions before 8.6.16; versions 9.0.0 to 9.5.2-alpha.3
Timeline
- 2026-03-11: disclosed: GHSA published
- 2026-03-10: advisory: NVD published CVE-2026-30947
- 2026-03-11: patched: Parse Server 8.6.16 and 9.5.2-alpha.3 released