CVE-2026-33163 - Vulnerability Details

- Parse Server leaks protected fields via LiveQuery afterEvent trigger

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to all subscribers of that class. Fields configured as protected via Class-Level Permissions (`protectedFields`) are included in LiveQuery event payloads for all event types (create, update, delete, enter, leave). Any user with sufficient CLP permissions to subscribe to the affected class can receive protected field data of other users, including sensitive personal information and OAuth tokens from third-party authentication providers. The vulnerability was caused by a reference detachment bug. When an `afterEvent` trigger is registered, the LiveQuery server converts the event object to a `Parse.Object` for the trigger, then creates a new JSON copy via `toJSONwithObjects()`. The sensitive data filter was applied to the `Parse.Object` reference, but the unfiltered JSON copy was sent to clients. The fix in versions 9.6.0-alpha.35 and 8.6.50 ensures that the JSON copy is assigned back to the response object before filtering, so the filter operates on the actual data sent to clients. As a workaround, remove all `Parse.Cloud.afterLiveQueryEvent` trigger registrations. Without an `afterEvent` trigger, the reference detachment does not occur and protected fields are correctly filtered.

Published: 2026-03-18

Score: 8.2 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in Parse Server allows an attacker to receive protected fields and authData for any user who has permission to subscribe to a class that has a `Parse.Cloud.afterLiveQueryEvent` trigger registered. Because the LiveQuery server creates an unfiltered JSON copy of the event object before applying the protected‑fields filter, payloads sent to subscribers contain sensitive personal information and OAuth tokens. This results in a confidentiality breach consistent with CWE‑200, where protected data is unintentionally disclosed to unauthorized parties.

Affected Systems

Affecting parse-community:parse-server versions prior to 9.6.0‑alpha.35 and 8.6.50. All alpha releases from 9.6.0‑alpha.1 through 9.6.0‑alpha.34 are impacted, as indicated by the CPE entries. Environments running these versions and executing a `Parse.Cloud.afterLiveQueryEvent` trigger for any class exposed to LiveQuery subscriptions are at risk.

Risk and Exploitability

The CVSS score of 8.2 classifies this as a high‑severity vulnerability. EPSS is reported as less than 1 %, suggesting a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires that an attacker can subscribe to the affected class and that a live‑query after‑event trigger is registered; no other special prerequisites are specified. The vulnerability exploits a reference detachment bug that leads to data leakage via the unfiltered JSON copy returned to clients.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

parse-community

parse-server

affected

Version	Status	Constraints
`>= 9.0.0, < 9.6.0-alpha.35`	affected	—
`< 8.6.50`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:parseplatform:parse-server::::::node.js::*
	cpe:2.3:a:parseplatform:parse-server::::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9::::node.js::*

No data.

Vendor Product Confidence Versions

Parse Community

Parse Server

100%

Version	Status	Scheme	Platform
`[9.0.0,9.6.0-alpha.35)`	affected	semver	—
`[0,8.6.50)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Parse Server to version 9.6.0‑alpha.35 or 8.6.50 or later, which removes the reference detachment bug
As a temporary workaround, remove all Parse.Cloud.afterLiveQueryEvent trigger registrations from your application to prevent the unfiltered JSON copy from being sent to clients
Verify the removal by checking LiveQuery event payloads or monitoring your logs for the presence of protected field data
Apply additional controls such as adjusting Class‑Level Permissions to restrict CLP subscriptions to trusted users

Generated by OpenCVE AI on March 19, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-5hmj-jcgp-6hff	Parse Server leaks protected fields via LiveQuery afterEvent trigger

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00028.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/parse-community/parse-server/pull/10232
https://github.com/parse-community/parse-server/pull/10233
https://github.com/parse-community/parse-server/security/advisories/GHSA-5hmj-jcgp-6hff

History

Thu, 19 Mar 2026 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Parseplatform Parseplatform parse-server
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:parseplatform:parse-server::::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9::::node.js::*
Vendors & Products		Parseplatform Parseplatform parse-server
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Thu, 19 Mar 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 19 Mar 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Parse Community Parse Community parse Server
Vendors & Products		Parse Community Parse Community parse Server

Wed, 18 Mar 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to all subscribers of that class. Fields configured as protected via Class-Level Permissions (`protectedFields`) are included in LiveQuery event payloads for all event types (create, update, delete, enter, leave). Any user with sufficient CLP permissions to subscribe to the affected class can receive protected field data of other users, including sensitive personal information and OAuth tokens from third-party authentication providers. The vulnerability was caused by a reference detachment bug. When an `afterEvent` trigger is registered, the LiveQuery server converts the event object to a `Parse.Object` for the trigger, then creates a new JSON copy via `toJSONwithObjects()`. The sensitive data filter was applied to the `Parse.Object` reference, but the unfiltered JSON copy was sent to clients. The fix in versions 9.6.0-alpha.35 and 8.6.50 ensures that the JSON copy is assigned back to the response object before filtering, so the filter operates on the actual data sent to clients. As a workaround, remove all `Parse.Cloud.afterLiveQueryEvent` trigger registrations. Without an `afterEvent` trigger, the reference detachment does not occur and protected fields are correctly filtered.
Title		Parse Server leaks protected fields via LiveQuery afterEvent trigger
Weaknesses		CWE-200
References		https://github.com/parse-community/parse-server/pull/10232 https://github.com/parse-community/parse-server/pull/10233 https://github.com/parse-community/parse-server/security/advisories/GHSA-5hmj-jcgp-6hff
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Parse Community Parse Server

Parseplatform Parse-server

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-03-18T21:58:04.293Z

Updated: 2026-03-19T14:00:33.619Z

Reserved: 2026-03-17T21:17:08.887Z

Link: CVE-2026-33163

Vulnrichment

Updated: 2026-03-19T14:00:28.885Z

NVD

Status : Analyzed

Published: 2026-03-18T22:16:26.270

Modified: 2026-03-19T16:35:28.417

Link: CVE-2026-33163

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-25T11:51:58Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object