CVE-2026-57481
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Parse Server allows a LiveQuery subscriber to receive object field values they are not authorized to read. This occurs when a single save operation changes both an object field and the subscriber's ACL read access, causing incorrect handling of leave and enter events.
Risk Assessment
The organization is at risk of sensitive data exposure, as unauthorized users may gain access to object fields that should be hidden from them.
Recommendation
Immediately update Parse Server to version 9.9.1-alpha.13 or 8.6.83, which contain the fix for this vulnerability.
Original NVD description (English source)
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.