Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1 and 8.6.83.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-57481US | — | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive obj… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/parse-community/parse-server/commit/c9b24cecfee76d8563019adaacbcbd78471dc41eWEB
- https://github.com/parse-community/parse-server/commit/e9c85dfe40a866a55ebae3b6ae56285ac0a22e64WEB
- https://github.com/parse-community/parse-server/pull/10515WEB
- https://github.com/parse-community/parse-server/pull/10516WEB
- https://github.com/parse-community/parse-server/releases/tag/8.6.83WEB
- https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.13WEB
- https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8rWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-57481WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan