Executive brief
Parse Server is an open-source backend framework used to power mobile and web applications. A vulnerability in its real-time data synchronization feature, LiveQuery, could allow a user to briefly see data they are not authorized to access. This occurs when a record's content and its access permissions are updated at the exact same time, potentially exposing sensitive information to a subscriber during the transition.
Technical details
An information disclosure vulnerability exists in Parse Server's LiveQuery component (CWE-200). When a single 'save' operation simultaneously modifies an object's data fields and its Access Control List (ACL), the LiveQuery 'enter' or 'leave' events may leak unauthorized states. Specifically, a 'leave' event triggered by a revocation of read access may include the post-update data, while an 'enter' event triggered by a grant of access may include the pre-update data the user was not yet permitted to see. This is limited to the specific object being updated and only affects the subscriber whose access is changing. The issue is resolved in versions 8.6.83 and 9.9.1-alpha.13 by verifying authorization for the specific object state included in the event.
Affected products
- Parse Community parse-server >= 9.0.0, < 9.9.1-alpha.13; <= 8.6.82
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory