Executive brief
Parse Server is a backend platform that manages data and real-time messaging for mobile and web applications. A vulnerability in the LiveQuery feature leaks sensitive protected fields (including OAuth tokens and personal data) to unauthorized users when afterEvent triggers are enabled. Any attacker with permissions to subscribe to affected data classes can intercept this protected information.
Technical details
This is a data exposure vulnerability (CWE-200) in Parse Server's LiveQuery afterEvent trigger handling. When a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server converts event objects to Parse.Object instances and creates unfiltered JSON copies via toJSONwithObjects(). The sensitive data filter is applied only to the Parse.Object reference, but the unfiltered JSON copy is sent to clients, bypassing field protection. The vulnerability affects all event types (create, update, delete, enter, leave) and leaks fields marked as protected via Class-Level Permissions (protectedFields) and authData containing third-party OAuth tokens. Exploitation requires the attacker to have sufficient Class-Level Permissions to subscribe to the affected class, but no additional authentication or user interaction is needed. The fix ensures the JSON copy is assigned back to the response object before filtering is applied. Patches are available in versions 9.6.0-alpha.35 and 8.6.50.
Affected products
- parse-community parse-server >= 9.0.0, < 9.6.0-alpha.35; < 8.6.50
Timeline
- 2026-03-18: disclosed
- 2026-03-17: patched: Patches merged for 9.6.0-alpha.35 and 8.6.50