Parse Server does not enforce class‑level permissions for LiveQuery subscriptions prior to version 8.6.16 and 9.5.2‑alpha.3. An unauthenticated or unauthorized client can subscribe to any LiveQuery‑enabled class and receive real‑time events for all objects regardless of the configured permissions. The result is a direct leak of data that should be restricted, allowing an attacker to exfiltrate sensitive information as it changes. This flaw is a classic example of a missing authorization check, identified as CWE‑863.

All deployments of Parse Server that use LiveQuery with class‑level permissions and are running a version earlier than 8.6.16 or earlier than 9.5.2‑alpha.3 are affected. The affected product is the open‑source Parse Server from Parse Platform, which can be hosted on any Node.js‑capable infrastructure.

The flaw has a high CVSS score of 8.7, indicating significant impact. The EPSS score is less than 1 %, suggesting that exploitation attempts are unlikely to be widespread at present, and it is not listed in the CISA KEV catalog. However, the vulnerability can be leveraged over the network by sending a subscription request to the LiveQuery endpoint. The attack is feasible for anyone with network access to the Parse Server instance, and no privileged credentials are required. Given the real‑time nature of the data leakage, the risk to confidentiality is high even if exploitation is currently rare.