CVE-2026-116161: Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Q: Which deployments are affected?

Parse Server versions before 8.6.103 are affected, as are versions from 9.0.0 through before 9.10.5-alpha.4. The issue is in LiveQuery subscription handling.

Q: What does an attacker need to exploit this issue?

An attacker needs to be an authenticated client and create a LiveQuery subscription using a query with a $or operator. Under those conditions, distinct subscriptions can be grouped together.

Q: What information could be exposed?

Affected clients can receive events belonging to other users. Exposed events may include session tokens that can be used to impersonate those users.

Q: Are authorization-related LiveQuery restrictions bypassed?

Yes. The omitted subscription-hash constraints include the _Session owner filter and beforeSubscribe constraints, allowing subscriptions with distinct restrictions to be grouped together.

Published Oct 25, 2026

Updated

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.

Affected Software

1 affected component

Parse Parse Server<8.6.103, >=9.0.0<9.10.5-alpha.4

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Parse Server versions before 8.6.103 are affected, as are versions from 9.0.0 through before 9.10.5-alpha.4. The issue is in LiveQuery subscription handling.

What does an attacker need to exploit this issue?

An attacker needs to be an authenticated client and create a LiveQuery subscription using a query with a $or operator. Under those conditions, distinct subscriptions can be grouped together.

What information could be exposed?

Affected clients can receive events belonging to other users. Exposed events may include session tokens that can be used to impersonate those users.

Are authorization-related LiveQuery restrictions bypassed?

Yes. The omitted subscription-hash constraints include the _Session owner filter and beforeSubscribe constraints, allowing subscriptions with distinct restrictions to be grouped together.

CVE-2026-116161: Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information could be exposed?

Are authorization-related LiveQuery restrictions bypassed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information could be exposed?

Are authorization-related LiveQuery restrictions bypassed?