Technical impact
The vulnerability is an information disclosure flaw in Parse Server's LiveQuery feature. When a client subscribes with a query that includes an $or operator, the server's subscription hash erroneously omits constraints such as the _Session owner filter and beforeSubscribe hooks. This omission causes distinct subscription requests to be treated as a single group. As a result, an authenticated client can inadvertently receive events meant for other users, including session tokens that can be used to impersonate those users. The flaw represents a classic CWE‑200 information exposure issue.
Affected Systems
All Parse Server releases prior to 8.6.103 and, for the 9.x lineage, before 9.10.5‑alpha.4 are affected. The vulnerability can impact any deployment that relies on LiveQuery subscriptions, regardless of the environment, as it depends on authenticated client access and $or query usage. Vendors listed by the CNA are the Parse Community’s parse-server project, which is typically distributed via npm and maintained under the parseplatform namespace.
Risk and Exploitability
The CVSS base score of 6.0 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not included in CISA’s KEV list, suggesting no current widespread exploitation. However, the attack model requires an attacker to authenticate to the server and issue a $or‑based LiveQuery subscription. Once accomplished, the attacker gains access to session tokens from other users, enabling impersonation or further compromise. Because the flaw arises from a missing filter in subscription handling, an automated client can carry out the exploitation with little effort, raising the likelihood for environments that expose LiveQuery to regular users. Control measures should therefore be applied promptly.
