Parse Server, an open‑source Node.js backend, enables LiveQuery subscriptions that can include a WHERE clause referencing protected fields. By creating such a subscription, an attacker can observe whether LiveQuery events are delivered for matching objects, effectively creating a boolean oracle. This allows the attacker to infer the values of protected fields without receiving them directly. The vulnerability is identified as a CWE‑200 information disclosure issue.

The vulnerability affects parse-community’s Parse Server. All releases prior to 9.6.0‑alpha.9 and 8.6.35 are vulnerable. Any class configured with protectedFields in its class‑level permissions and with LiveQuery enabled is susceptible.

The CVSS score of 6.9 indicates a moderate severity. An EPSS score of less than 1% suggests the exploitation probability is currently low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via the LiveQuery subscription API. An attacker can craft a subscription that references a protected field, observe event delivery, and deduce the field’s value, thereby compromising confidentiality of protected data.