CVE-2026-100632 in Parse Server
Summary
by MITRE • 09/26/2026
Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
Parse Server versions ranging from 9.0.0 up to but not including 9.10.1-alpha.8, as well as all versions prior to 8.6.89, contain a critical logic flaw within the LiveQuery subsystem that compromises data confidentiality through improper identity resolution during field-level permission evaluation. This vulnerability stems from an incomplete handling of the caller identity when determining which fields should be masked or redacted in response events. Specifically, the system fails to resolve the subscriber's roles and session context accurately before applying protectedFields class-level permissions. Consequently, if a subscription request does not explicitly supply its own session token, the event payload is processed against an anonymous identity rather than the authenticated user who established the connection. This discrepancy means that field masks defined for specific roles, authenticated users, or individual users are effectively bypassed because the system incorrectly assumes no access rights exist beyond public permissions during this evaluation phase.
The operational impact of this flaw allows authenticated subscribers to receive sensitive data fields that should have been withheld according to their actual authorization level. In a correctly functioning scenario, the REST API would enforce these field masks and prevent unauthorized users from viewing restricted attributes such as personal identifiable information or internal system flags. However, due to the LiveQuery vulnerability, an attacker with valid authentication can subscribe to affected classes and receive real-time updates containing masked data. Furthermore, this exposure extends beyond simple data leakage; because the masked fields remain accessible in the event payload, they can be utilized by malicious actors as filters or watch conditions for other subscriptions. This capability significantly expands the attack surface, enabling attackers to refine their queries based on sensitive criteria that were intended to be hidden, thereby facilitating more targeted and effective exploitation of subsequent vulnerabilities or data exfiltration attempts.
This vulnerability is categorized under CWE-209: Generation of Error Message Containing Sensitive Information when considering the exposure aspect, but its core nature aligns with CWE-863: Incorrect Authorization, as it represents a failure to enforce access control restrictions properly during runtime operations. In terms of adversarial tactics, this flaw relates to ATT&CK technique T1074: Data Staged or Local Exfiltration over Unencrypted Non-C2 Protocol if the leaked data is used for staging, and more broadly to unauthorized access patterns described in techniques involving improper authentication handling. The issue specifically affects classes where LiveQuery is enabled and protectedFields are defined under role-based, authenticated user, or per-user groups. Classes that define masks exclusively under the public group remain unaffected because those permissions do not rely on resolving complex identity contexts for enforcement.
To mitigate this risk immediately upon discovery, administrators should apply one of two workarounds until an upgrade is feasible. The first approach involves modifying class-level permissions to additionally define the affected field masks under the public group designation. This ensures that even if the identity resolution fails and defaults to anonymous context, the fields remain masked because public access rules are applied regardless of user state. Alternatively, administrators can disable LiveQuery for any classes whose security model relies heavily on role-scoped or per-user protectedFields groups. Disabling this feature removes the attack vector entirely by preventing real-time subscription events from being generated with flawed permission checks. The definitive resolution is achieved by upgrading Parse Server to version 9.10.1-alpha.8 or later, or for legacy systems, upgrading to version 8.6.89 and above, where the identity resolution logic has been corrected to properly evaluate subscriber roles and session tokens before applying field masks.