Based on the description, the likely attack vector involves modifying an object’s ACL read permissions during a save operation and then subscribing to the LiveQuery. Parse Server’s LiveQuery feature may leak hidden data to subscribers when the object’s ACL read permissions are altered during a save. In affected versions prior to 9.9.1-alpha.13 and 8.6.83, a save operation that changes both a field value and the ACL read access triggers leave and enter events that contain the object’s state before the ACL update. As a result, a subscriber who gains new read access can receive values they were not authorized to see, violating confidentiality. The flaw is a classic information‑disclosure weakness (CWE‑200).

Vendors: parse-community. Product: Parse Server. Affected releases include all versions older than 9.9.1-alpha.13 and 8.6.83. The issue has been fixed in 9.9.1-alpha.13 and 8.6.83, which are the minimum versions that provide the protection.

The CVSS score of 2.3 indicates a low severity. The EPSS score of less than 1% signifies a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by performing a write that changes ACL read permissions and field values, then subscribing to the affected LiveQuery. The exploitation details are inferred from the description, and it requires permissions to modify the object's ACL. Once a subscription is established, the attacker receives the sensitive data through the improper event payloads.