Prior to certain releases of Parse Server, an authenticated user who has permission to perform find operations can circumvent the protectedFields guard on LiveQuery subscriptions. By sending a subscription payload that includes a logical operator such as $or, $and, or $nor, the attacker can replace the expected array with an "array-like" object that has numeric keys and a length property. The resulting subscription event acts as a binary oracle, revealing whether a protected field contains a value that matches the attacker’s test. The primary consequence is unauthorized disclosure of data that should be hidden from that user. This vulnerability does not allow arbitrary code execution but can leak confidential information.

The issue affects parse-community's open-source Parse Server deployments. Versions older than or equal to 8.6.69 and 9.7.0-alpha.17 are vulnerable, while 8.6.70 and 9.7.0-alpha.18 patch the flaw. Any infrastructure running those older versions of the software is at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting lower known exploitation activity so far. However, the attack requires the attacker to be authenticated and to have find permissions on the target class. Once those conditions are met, the attacker can craft a subscription payload to infer protected field values. Because the exploit relies on normal API usage, it could be performed by any authenticated user if permissions are improperly configured. The risk of data leakage warrants prompt attention.