Executive brief
Parse Server is an open-source backend framework used to build and host applications. A security flaw in its real-time data synchronization feature (LiveQuery) could allow unauthorized users to view sensitive data. This occurs when a single update simultaneously changes a piece of data and the permissions for who can see it, potentially leaking information to users who should no longer have access.
Technical details
An information disclosure vulnerability exists in Parse Server's LiveQuery component due to incorrect object state handling during 'leave' and 'enter' events. When a single save operation modifies both an object field and the subscriber's ACL read access, the system may include unauthorized field values in the event notification sent to the subscriber. This occurs because the events are triggered using an incorrect state of the object relative to the permission change. The vulnerability is reachable over the network by an authenticated user with an active LiveQuery subscription. Patches are available in versions 9.9.1-alpha.13 and 8.6.83.
Affected products
- parse-community parse-server >= 9.0.0-alpha.1, < 9.9.1-alpha.13; < 8.6.83
Timeline
- 2026-06-19: patched: Fixes committed to repository
- 2026-07-08: disclosed: CVE published
References
- https://github.com/parse-community/parse-server/commit/c9b24cecfee76d8563019adaacbcbd78471dc41e
- https://github.com/parse-community/parse-server/commit/e9c85dfe40a866a55ebae3b6ae56285ac0a22e64
- https://github.com/parse-community/parse-server/pull/10515
- https://github.com/parse-community/parse-server/pull/10516
- https://github.com/parse-community/parse-server/releases/tag/8.6.83
- https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.13
- https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8r