CVE-2026-100632

Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-100632

Published

Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-100632

Published

parse-server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "parse-community",
                    "product": "parse-server",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:npm/parse-server",
                    "versions": [
                        {
                            "version": "9.0.0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "9.10.1-alpha.8"
                        },
                        {
                            "version": "9.10.1-alpha.8",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

parse-server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "parse-community",
                    "product": "parse-server",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:npm/parse-server",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "8.6.89"
                        },
                        {
                            "version": "8.6.89",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON