CVE-2026-116161
Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.
| CWE | CWE-200 |
| Vendor | parse-community |
| Product | parse-server |
| Published | Oct 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for parse-community parse-server
Be the first to know when new unknown vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
parse-community / parse-server
9.0.0 < 9.10.5-alpha.4
parse-community / parse-server
0 < 8.6.103
References
Credits
mtrezza