Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1 and 8.6.83.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-57481US | — | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive obj… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/parse-community/parse-server/commit/c9b24cecfee76d8563019adaacbcbd78471dc41eWEB
- https://github.com/parse-community/parse-server/commit/e9c85dfe40a866a55ebae3b6ae56285ac0a22e64WEB
- https://github.com/parse-community/parse-server/pull/10515WEB
- https://github.com/parse-community/parse-server/pull/10516WEB
- https://github.com/parse-community/parse-server/releases/tag/8.6.83WEB
- https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.13WEB
- https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8rWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-57481WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan