CVE-2026-33163
Information Disclosure in Parse Server LiveQuery via afterLiveQueryEvent Trigger
Publication date: 2026-03-18
Last updated on: 2026-03-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | From 9.0.0 (inc) to 9.6.0 (exc) |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | to 8.6.50 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Parse Server versions prior to 9.6.0-alpha.35 and 8.6.50. When a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to all subscribers of that class.
Protected fields configured via Class-Level Permissions (protectedFields) are included in LiveQuery event payloads for all event types such as create, update, delete, enter, and leave.
Any user with sufficient Class-Level Permission to subscribe to the affected class can receive protected field data of other users, including sensitive personal information and OAuth tokens from third-party authentication providers.
The root cause is a reference detachment bug where the LiveQuery server creates a JSON copy of the event object but applies the sensitive data filter only to the original object reference, not the JSON copy sent to clients.
The fix ensures the JSON copy is assigned back to the response object before filtering, so the filter operates on the actual data sent to clients.
As a workaround, removing all `Parse.Cloud.afterLiveQueryEvent` trigger registrations prevents the reference detachment and ensures protected fields are correctly filtered.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive data.
Users who have permission to subscribe to a class can receive protected fields and authentication data of other users, including sensitive personal information and OAuth tokens.
This exposure can compromise user privacy and security, potentially allowing attackers or unauthorized users to access or misuse sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, remove all Parse.Cloud.afterLiveQueryEvent trigger registrations from your Parse Server setup.
Without an afterEvent trigger, the reference detachment bug does not occur and protected fields are correctly filtered, preventing leakage of sensitive data.
Additionally, upgrade your Parse Server to version 9.6.0-alpha.35 or later, or 8.6.50 or later, where the vulnerability has been fixed.