Executive brief
Parse Server is a backend-as-a-service platform that uses Class-Level Permissions to restrict access to sensitive data. The LiveQuery real-time update feature bypasses these pointer permission restrictions, allowing any authenticated user to receive data updates they shouldn't have access to. This undermines data access controls that are correctly enforced via the REST API, potentially exposing sensitive information to unauthorized users.
Technical details
Parse Server's LiveQuery WebSocket interface fails to enforce Class-Level Permission (CLP) pointer permissions (readUserFields and pointerFields) on subscribed objects. Any authenticated user can subscribe to LiveQuery events and receive real-time object updates regardless of whether pointer fields on those objects reference the subscribing user. The vulnerability affects versions 0–8.6.52 and 9.0.0–9.6.0-alpha.41. The fix checks configured pointer fields on each event to verify they point to the subscribing user; mismatched events are silently skipped. Attack requires network connectivity and valid authentication; confidentiality impact is high as unauthorized users can access sensitive data through subscriptions.
Affected products
- Parse Community Parse Server before 8.6.53; 9.0.0 before 9.6.0-alpha.42
Timeline
- 2026-03-20: disclosed: GHSA-fph2-r4qg-9576 published
- 2026-03-20: patched: Patches released: Parse Server 8.6.53 and 9.6.0-alpha.42