The vulnerability arises in Parse Server's LiveQuery feature, which incorrectly evaluates a subscriber's permissions when the subscriber's role information is not fully resolved. Because LiveQuery does not resolve roles and treats a subscription without a session token as an anonymous user, the framework fails to enforce the protectedFields masks that are normally applied to role‑scoped, authenticated, or per‑user data. In effect, an authenticated subscriber can receive field values that the REST API correctly hides, allowing an attacker to acquire confidential data that should be masked. The flaw is limited to LiveQuery subscriptions and does not grant arbitrary code execution, but it does provide a significant information disclosure that can reveal sensitive application data.

The flaw affects Parse Server community edition across two version ranges. Clients running Parse Server versions 9.0.0 up to, but not including, 9.10.1‑alpha.8 are vulnerable, as are clients on the 8.x series before version 8.6.89. Only classes that have LiveQuery enabled and define protectedFields under a role:, authenticated, or per‑user group are impacted; masks defined for the public (*) group are applied correctly. The issue is addressed in the 9.10.1‑alpha.8 release and in 8.6.89.

The CVSS score is 7.1, indicating a medium‑to‑high risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the attacker only needs to be an authenticated user with a valid LiveQuery subscription, the exploitation path is straightforward via the live monitoring endpoint. The risk is therefore significant in environments with many subscribed clients, and the lack of EPSS data suggests that there are no confirmed real‑world exploits yet, but the potential for abuse remains high. Quick remediation is recommended.