CVE-2026-100632
Received Received - Intake

LiveQuery Field Exposure in Parse Server

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100632
EUVD
EUVD-2026-87726

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
parse_server parse_server From 9.0.0 (inc) to 9.10.1-alpha.8 (exc)
parse_server parse_server to 8.6.89 (exc)
parse_server parse_server 9.10.1-alpha.8
parse_server parse_server 8.6.89
parse server From 9.0.0 (inc) to 9.10.1-alpha.8 (exc)
parse server to 8.6.89 (inc)
parse server to 8.6.89 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Parse Server versions between 9.0.0 and 9.10.1-alpha.7, and versions below 8.6.89. LiveQuery incorrectly handles protected fields by not fully resolving the subscriber's identity, particularly their roles. When a subscription lacks a session token, LiveQuery defaults to an anonymous identity for permission checks, ignoring role-based, authenticated user, or per-user field masks. This allows authenticated subscribers to receive data that should be hidden, bypassing class-level permissions.

Detection Guidance

To detect this vulnerability, check if your Parse Server version is between 9.0.0 and 9.10.1-alpha.7 or below 8.6.89. Use commands like 'npm list parse-server' or check your server logs for version details. Verify if LiveQuery is enabled on classes with protectedFields defined under role, authenticated, or per-user groups.

Impact Analysis

An attacker could exploit this to access sensitive data through LiveQuery subscriptions that should be restricted by class-level permissions. Even if the REST API correctly withholds data, LiveQuery may expose it, leading to unauthorized access to confidential information like user details or role-specific fields.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements for data protection such as GDPR and HIPAA. It risks exposing sensitive personal or health information, potentially resulting in legal penalties, reputational damage, and loss of trust due to non-compliance with privacy regulations.

Mitigation Strategies

Upgrade Parse Server to version 9.10.1-alpha.8 or 8.6.89 or later. Alternatively, add affected field masks under the public group or disable LiveQuery for classes using role-scoped, authenticated, or per-user protectedFields groups as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart