Executive brief
Parse Server is a backend-as-a-service framework that provides database and API services for mobile and web applications. An attacker can bypass access controls on sensitive fields by exploiting LiveQuery subscriptions, allowing them to infer the values of protected fields through a series of queries. This exposure of protected data could compromise customer privacy and violate security policies for applications using Parse Server.
Technical details
The vulnerability is an information disclosure (CWE-200) affecting the LiveQuery subscription mechanism. An attacker can reference protected fields in a LiveQuery WHERE clause (including via dot-notation or $regex operators) and observe whether events are delivered for matching objects, creating a boolean oracle that leaks protected field values. The attack requires only network access to a Parse Server instance with LiveQuery enabled on a class that has protectedFields configured in Class-Level Permissions; no authentication or user interaction is needed. The fix validates LiveQuery subscription WHERE clauses against the class's protected fields and rejects subscriptions that reference protected fields directly or through operators like $or, $and, $nor.
Affected products
- Parse Community Parse Server all versions before 8.6.35 and 9.0.0 through before 9.6.0-alpha.9
Timeline
- 2026-03-12: disclosed: GHSA-j7mm-f4rv-6q6q published on GitHub Advisory Database
- 2026-03-12: patched: Parse Server 8.6.35 and 9.6.0-alpha.9 released with fix