CVE-2026-30947: Parse Server Information Disclosure Bug

CVE-2026-30947 Overview

CVE-2026-30947 is an Authorization Bypass vulnerability in Parse Server, an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 9.5.2-alpha.3 and 8.6.16, class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any LiveQuery-enabled class and receive real-time events for all objects, regardless of CLP restrictions.

This vulnerability affects all Parse Server deployments that use LiveQuery with class-level permissions. The flaw allows attackers to bypass access controls and receive real-time data streams that should be restricted, leading to significant unauthorized information disclosure.

Critical Impact

Data intended to be restricted by class-level permissions is leaked to unauthorized subscribers in real time, enabling attackers to monitor sensitive object changes without authentication.

Affected Products

• parseplatform parse-server versions prior to 8.6.16
• parseplatform parse-server versions 9.5.2-alpha1 and 9.5.2-alpha2
• All Parse Server deployments using LiveQuery with class-level permissions

Discovery Timeline

• 2026-03-10 - CVE-2026-30947 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30947

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization). The root cause lies in Parse Server's LiveQuery subscription handler, which fails to validate class-level permissions before allowing clients to subscribe to real-time event streams.

LiveQuery is a feature in Parse Server that enables real-time data synchronization by allowing clients to subscribe to object changes. When properly configured, class-level permissions should restrict which users can read, write, or otherwise interact with objects in specific classes. However, the affected versions do not enforce these permissions during the subscription process.

The network-accessible attack vector requires no authentication and no user interaction. An attacker can establish a WebSocket connection to the LiveQuery server and subscribe to any class, regardless of the CLP configuration. Once subscribed, the attacker receives real-time notifications whenever objects in that class are created, updated, or deleted—exposing potentially sensitive data that administrators believed was protected.

Root Cause

The vulnerability stems from a missing authorization check in the LiveQuery subscription flow. When a client initiates a subscription request, Parse Server validates the connection but fails to verify whether the requesting client has the necessary class-level permissions to access the specified class. This oversight allows the subscription to proceed without proper access control validation, bypassing the intended security model.

Attack Vector

The attack exploits the network-accessible LiveQuery WebSocket endpoint. An attacker can connect to the LiveQuery server and issue subscription requests for any LiveQuery-enabled class. Since CLP validation is missing from the subscription handler, the server accepts the subscription and begins streaming real-time object events to the unauthorized client.

The attack requires no prior authentication, making it accessible to any network attacker who can reach the LiveQuery endpoint. The attacker receives a continuous stream of data changes, potentially including sensitive user information, application state, or business-critical data that was intended to be access-controlled.

For detailed technical information about the vulnerability mechanism, see the GitHub Security Advisory GHSA-7ch5-98q2-7289.

Detection Methods for CVE-2026-30947

Indicators of Compromise

• Unusual WebSocket connections to LiveQuery endpoints from untrusted IP addresses
• Subscription requests from unauthenticated sessions to CLP-protected classes
• Anomalous spikes in LiveQuery subscription activity without corresponding authenticated user sessions
• Log entries showing subscription events from clients without valid session tokens

Detection Strategies

• Monitor LiveQuery WebSocket connections for subscription attempts to sensitive classes without proper authentication headers
• Implement logging for all LiveQuery subscription requests and correlate with authentication status
• Review Parse Server access logs for subscription patterns that bypass normal application workflows
• Deploy network-level monitoring to detect unexpected connections to the LiveQuery port from external sources

Monitoring Recommendations

• Enable verbose logging for the LiveQuery server component to capture subscription metadata
• Configure alerts for LiveQuery subscriptions to classes containing sensitive data
• Implement session validation logging to identify subscription attempts without valid authentication
• Monitor for rapid successive subscription attempts across multiple classes, which may indicate reconnaissance activity

How to Mitigate CVE-2026-30947

Immediate Actions Required

• Upgrade Parse Server to version 8.6.16 or 9.5.2-alpha.3 immediately
• Audit existing LiveQuery subscriptions to identify any unauthorized access that may have occurred
• Review class-level permissions configuration to ensure sensitive classes have appropriate restrictions
• Consider temporarily disabling LiveQuery for highly sensitive classes until patches are applied

Patch Information

Parse Server has released security patches addressing this vulnerability in versions 8.6.16 and 9.5.2-alpha.3. Organizations should upgrade to these versions immediately to ensure class-level permissions are properly enforced for LiveQuery subscriptions.

• GitHub Parse Server Release 8.6.16 - Stable release with fix
• GitHub Parse Server Release 9.5.2-alpha.3 - Alpha release with fix

For complete vulnerability details and remediation guidance, refer to the GitHub Security Advisory GHSA-7ch5-98q2-7289.

Workarounds

• Disable LiveQuery functionality entirely for sensitive classes until the patch is applied
• Implement network-level access controls to restrict LiveQuery endpoint access to trusted clients only
• Deploy a reverse proxy or application firewall to validate authentication before allowing WebSocket connections
• Consider using server-side filtering to limit data exposure while awaiting patch deployment

# Example: Upgrade Parse Server to patched version
npm update parse-server@8.6.16

# Verify installed version
npm list parse-server