CVE-2026-100632: Exposure of Sensitive Information to an Unauthorized Actor in parse-community parse-server
Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.
AI Analysis
Technical Summary
In parse-community's parse-server, a vulnerability (CVE-2026-100632) exists in LiveQuery permission evaluation for protectedFields. When a subscription lacks its own session token, the system redacts event payloads against an anonymous identity rather than the connected user's resolved roles. Consequently, field masks for roles, authenticated users, or specific users are not applied, exposing sensitive fields to unauthorized subscribers. This flaw affects only classes with LiveQuery enabled and protectedFields defined under role:, authenticated, or per-user groups. Masks under the public group are correctly applied. The vulnerability is resolved in versions 9.10.1-alpha.8 and 8.6.89.
Potential Impact
Authenticated subscribers to LiveQuery can receive sensitive field data that should be masked according to class-level permissions. This exposure bypasses intended field-level protections for roles, authenticated users, or specific users, potentially leaking sensitive information. The REST API enforces these masks correctly, but LiveQuery does not, leading to inconsistent access control.
Mitigation Recommendations
A fix is available in parse-server versions 9.10.1-alpha.8 and 8.6.89; upgrading to these or later versions is recommended. As a workaround, define affected field masks under the public (*) group or disable LiveQuery for classes relying on role-scoped, authenticated, or per-user protectedFields groups. No other vendor advisory mitigation instructions are provided.
CVE-2026-100632: Exposure of Sensitive Information to an Unauthorized Actor in parse-community parse-server
Description
Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.
CVSS v4.0
Score 7.1high
Affected software
parse-community
parse-server
parse-community
parse-server
pkg:github/parse-community/parse-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In parse-community's parse-server, a vulnerability (CVE-2026-100632) exists in LiveQuery permission evaluation for protectedFields. When a subscription lacks its own session token, the system redacts event payloads against an anonymous identity rather than the connected user's resolved roles. Consequently, field masks for roles, authenticated users, or specific users are not applied, exposing sensitive fields to unauthorized subscribers. This flaw affects only classes with LiveQuery enabled and protectedFields defined under role:, authenticated, or per-user groups. Masks under the public group are correctly applied. The vulnerability is resolved in versions 9.10.1-alpha.8 and 8.6.89.
Potential Impact
Authenticated subscribers to LiveQuery can receive sensitive field data that should be masked according to class-level permissions. This exposure bypasses intended field-level protections for roles, authenticated users, or specific users, potentially leaking sensitive information. The REST API enforces these masks correctly, but LiveQuery does not, leading to inconsistent access control.
Mitigation Recommendations
A fix is available in parse-server versions 9.10.1-alpha.8 and 8.6.89; upgrading to these or later versions is recommended. As a workaround, define affected field masks under the public (*) group or disable LiveQuery for classes relying on role-scoped, authenticated, or per-user protectedFields groups. No other vendor advisory mitigation instructions are provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:31:42.100Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9a5f7a7c5410652fd1b
Added to database: 09/26/2026, 13:33:25 UTC
Last enriched: 09/26/2026, 14:17:39 UTC
Last updated: 09/27/2026, 01:57:11 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.