CVE-2026-100632: Parse Server Information Disclosure Flaw

CVE-2026-100632 Overview

Parse Server contains an information disclosure vulnerability in its LiveQuery subsystem. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity. The subscriber's roles are not resolved, and when a subscription does not supply its own session token, the event payload is redacted against an anonymous identity. Field masks defined for a role, for authenticated users, or for a specific user are not applied. An authenticated subscriber can receive field values that the REST API correctly withholds, and can use a masked field to filter or watch a subscription. The flaw is classified as [CWE-200] Information Exposure.

Critical Impact
Authenticated LiveQuery subscribers can read protected field values that the REST API withholds, breaking role-scoped, authenticated, and per-user data confidentiality controls.

Affected Products

Parse Server versions >= 9.0.0 and < 9.10.1-alpha.8
Parse Server versions < 8.6.89
Classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group

Discovery Timeline

2026-09-26 - CVE-2026-100632 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100632

Vulnerability Analysis

Parse Server exposes a LiveQuery service that streams database change events to subscribed clients over WebSocket. Access to each event is governed by class-level permissions (CLPs), including protectedFields, which define per-field redaction rules keyed by audience: public (*), authenticated, a role (role:<name>), or a specific user. The REST API resolves the caller's full identity, including role memberships, before applying these masks. LiveQuery does not. The subscriber's roles are never resolved, and if a subscription omits its own session token, the event payload is redacted against an anonymous caller even though the underlying read was authorized against the connected user. The result is a privilege mismatch: the read passes as the authenticated user, but the redaction runs as an anonymous actor.

Root Cause

The root cause is an incomplete identity resolution path in the LiveQuery event dispatcher. Role resolution is skipped, and session-token fallback logic defaults to an anonymous principal when the subscription payload does not include one. Only protectedFields entries under the public (*) group match the resolved identity, so role-scoped, authenticated, and per-user masks are silently bypassed.

Attack Vector

An attacker needs valid authentication to the target Parse Server deployment and the ability to open a LiveQuery subscription on a class whose protectedFields rules depend on role, authenticated, or per-user groups. The attacker subscribes to the class, optionally with a server-side filter referencing a field that should be masked, and receives event payloads containing unredacted field values. The disclosed values can also be used as filter predicates to confirm the presence of specific records. The attack is network-based, requires low privileges, and no user interaction. See the GitHub Security Advisory and the VulnCheck Advisory on Parse Server for additional detail.

Detection Methods for CVE-2026-100632

Indicators of Compromise

LiveQuery WebSocket subscriptions on classes that define protectedFields under role:, authenticated, or per-user groups.
Subscription messages missing a sessionToken field despite originating from authenticated clients.
Client-side filter predicates (where clauses) that reference fields intended to be masked for the subscriber.

Detection Strategies

Audit the Parse Server configuration and schema for classes with LiveQuery enabled and compare their protectedFields definitions against the public (*) group coverage.
Enable verbose LiveQuery logging and inspect dispatched payloads to confirm whether role-scoped or per-user masks are being applied to outbound events.
Replay representative subscriptions in a test environment to verify that fields hidden by the REST API are also hidden over LiveQuery.

Monitoring Recommendations

Monitor LiveQuery subscription volume per authenticated user and alert on anomalous subscription patterns on sensitive classes.
Log and review subscriptions whose where filters reference protected fields, as these may indicate probing for masked values.
Centralize Parse Server application and LiveQuery logs in a SIEM for retrospective hunting against the affected version ranges.

How to Mitigate CVE-2026-100632

Immediate Actions Required

Upgrade Parse Server to version 9.10.1-alpha.8 or 8.6.89, which contain the fix.
Inventory all classes with LiveQuery enabled and identify any that rely on role:, authenticated, or per-user protectedFields groups.
Rotate session tokens for any users whose data may have been exposed through affected LiveQuery subscriptions.

Patch Information

The issue is fixed in Parse Server 9.10.1-alpha.8 and 8.6.89. Both releases resolve the caller identity, including role membership, before applying protectedFields redaction to LiveQuery event payloads. Patch details are available in the GitHub Security Advisory GHSA-9jpp-xhh6-75mf.

Workarounds

Additionally define the affected field masks under the public (*) group so that redaction applies regardless of the resolved caller identity.
Disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.
Require clients to supply a valid sessionToken when creating LiveQuery subscriptions on sensitive classes.

bash

# Example: upgrade Parse Server via npm to a fixed release
npm install parse-server@8.6.89
# or, for the 9.x branch
npm install parse-server@9.10.1-alpha.8