Parse Server’s LiveQuery feature processes multiple client subscriptions concurrently using shared mutable objects. Prior to version 8.6.65 and 9.7.0‑alpha.9, the filter that removes protected fields modifies these objects in-place. As a result, a subscriber that removes a protected field can cause the underlying object to appear altered to a subsequent subscriber, leading to the accidental disclosure of protected data or authentication information. The vulnerability also allows shared state modifications in afterEvent Cloud Code triggers to leak data between subscribers. This is a concurrency-based error (CWE‑362).

Any deployment of Parse Server from parse-community:parse-server before version 8.6.65 or before 9.7.0‑alpha.9 that uses LiveQuery with protected fields or afterEvent triggers is affected. The specific release tree includes the alpha series through 9.7.0‑alpha.8 and earlier stable releases up to but excluding 8.6.65.

The vulnerability scores a CVSS 8.2 indicating high severity. The EPSS score is less than 1 %, suggesting low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to be able to subscribe to the same LiveQuery class, either through an exposed API endpoint or an application’s client library, and to send data that triggers the shared mutable state path. The impact is limited to the data returned for that class, but the disclosure of protected fields or authentication details can be consequential. Attackers with knowledge of the data model and suitable access permissions can use this avenue to gain unintended insight into privileged data.