{"id":"EUVD-2026-42422","enisaUuid":"b5193267-000b-3be5-b738-048c7bb8f7c9","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber\u0027s ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.","datePublished":"Jul 8, 2026, 8:54:55 PM","dateUpdated":"Jul 10, 2026, 2:14:39 PM","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8r\nhttps://github.com/parse-community/parse-server/pull/10515\nhttps://github.com/parse-community/parse-server/pull/10516\nhttps://github.com/parse-community/parse-server/commit/c9b24cecfee76d8563019adaacbcbd78471dc41e\nhttps://github.com/parse-community/parse-server/commit/e9c85dfe40a866a55ebae3b6ae56285ac0a22e64\nhttps://github.com/parse-community/parse-server/releases/tag/8.6.83\nhttps://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.13\n","aliases":"CVE-2026-57481\n","assigner":"GitHub_M","epss":0.53,"enisaIdProduct":[{"id":"8234ff19-fb36-3b01-be93-b444f52d86ef","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.83"},{"id":"ecaff237-d652-3d68-bc05-b0cd906967f0","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0-alpha.1, \u003c 9.9.1-alpha.13"}],"enisaIdVendor":[{"id":"d8b3b944-4776-3a36-98d9-f39d2f90a38d","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"f5971200-7447-3b83-9a0f-56e05a6ea6fe","vulnerability":{"id":"CVE-2026-57481","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber\u0027s ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.","datePublished":"Jul 8, 2026, 8:54:55 PM","dateUpdated":"Jul 10, 2026, 2:14:39 PM","status":"PUBLISHED","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8r\nhttps://github.com/parse-community/parse-server/pull/10515\nhttps://github.com/parse-community/parse-server/pull/10516\nhttps://github.com/parse-community/parse-server/commit/c9b24cecfee76d8563019adaacbcbd78471dc41e\nhttps://github.com/parse-community/parse-server/commit/e9c85dfe40a866a55ebae3b6ae56285ac0a22e64\nhttps://github.com/parse-community/parse-server/releases/tag/8.6.83\nhttps://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.13\n","enisa_id":"EUVD-2026-42422\n","assigner":"GitHub_M","epss":0.53,"dataProcessed":"Oct 30, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"04bce6f2-fa4f-390f-be79-db2931995fbd","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.83"},{"id":"1097a775-d6d5-3cb1-96e0-63f8c46d3468","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0-alpha.1, \u003c 9.9.1-alpha.13"}],"vulnerabilityVendor":[{"id":"1f4e3145-92c4-36cf-8cdb-b055dc12eb50","vendor":{"name":"parse-community"}}]}}],"enisaIdAdvisory":[]}