The vulnerability lies in Parse Server’s LiveQuery WebSocket interface, which, before versions 8.6.53 and 9.6.0-alpha.42, fails to enforce Class-Level Permission (CLP) pointer permissions such as readUserFields and pointerFields. As a result, any authenticated user can subscribe to LiveQuery events and receive real‐time updates for all objects in classes that normally protect pointer fields. This bypass directly violates the intended read access control and allows an attacker to view sensitive data that would otherwise be hidden by the REST API.

The issue affects the open‑source Parse Server (parse-community:parse‑server) running on Node.js. All released versions prior to 8.6.53 and 9.6.0‑alpha.42 are vulnerable, including the numerous alpha releases enumerated in the CPE list.

The CVSS score of 7.1 indicates a moderate to high level of severity. The EPSS score of less than 1 % suggests that exploitation is unlikely in the near term, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely occur through an authenticated WebSocket connection to the LiveQuery endpoint, enabling an attacker to subscribe to updates and capture data that should be inaccessible.