Parse Server allows clients to subscribe to LiveQuery updates with a watch parameter targeting a protected field; although the field value is removed from payloads, the mere occurrence or absence of update events signals whether the protected field has changed, creating a binary oracle. An attacker can infer the presence of a change and, for boolean fields, can deduce the exact value by observing the timing of notifications, thereby leaking sensitive data that should remain hidden.

All Versions of the open‑source Parse Server developed by parse‑community, prior to 8.6.54 and 9.6.0‑alpha.43, are affected. The vulnerability applies to Deployments running on any Node.js‑capable infrastructure that hosts those versions.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploit has been reported, but the attack vector is inferred to be remote, as an attacker must send LiveQuery subscriptions to a publicly or internally reachable Parse Server instance.