Description

Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:44.540Z",
  "pubdate": "2026-09-26T14:16:44.540Z",
  "executiveSummary": "Parse Server contains a critical authorization bypass vulnerability within its LiveQuery implementation, where protectedFields class-level permissions are incorrectly evaluated against an incomplete caller identity.\nThe vulnerability occurs because LiveQuery fails to resolve the subscriber's roles or user context when processing subscription events, causing the system to treat the request as anonymous rather than authenticated.\nThis failure prevents the application of field-level masks defined for specific roles, authenticated users, or individual users, resulting in unauthorized data exposure.\nAn authenticated attacker can exploit this to view sensitive field values that are strictly withheld by the REST API, or use masked fields to filter and manipulate subscription streams.\nThe flaw affects versions >= 9.0.0 and < 9.10.1-alpha.8, and versions < 8.6.89. Risk is high for any deployment utilizing LiveQuery on classes with restricted protectedFields configurations, as it circumvents established Data Loss Prevention (DLP) controls and privacy enforcement mechanisms.\nExploitation requires the attacker to be an authenticated subscriber of a class where protectedFields are enforced via non-public (authenticated, role-based, or user-specific) policies.",
  "technicalDetails": "The vulnerability originates in the LiveQuery component's authentication and authorization resolution logic. Specifically, when a LiveQuery subscription is established, the system evaluates the class-level permissions (CLP) for protectedFields; however, the resolution engine fails to correctly propagate the authenticated user's session state and role context to the event dispatch mechanism.\nThe root cause is an incompletely resolved caller identity. While the initial connection may be authorized, the subsequent processing of event payloads defaults to an anonymous identity context when the subscription lacks its own explicit session token. Consequently, the redaction engine, which is responsible for applying field masks to outgoing JSON payloads, fails to identify the subscriber's elevated permissions or role-based access rights.\nIn a successful attack scenario: 1) An authenticated user initiates a LiveQuery subscription to a collection where specific sensitive fields are protected under 'authenticated' or 'role' CLP settings. 2) The server grants the subscription, correctly authorizing the user for the class level. 3) When an update occurs, the LiveQuery server processes the event. 4) Due to the faulty identity resolution, the system incorrectly treats the event payload redaction process as if the recipient were an unauthenticated/public user. 5) The server ignores the protectedFields configuration that should have masked specific fields, transmitting the sensitive raw data to the attacker’s client.\nBecause the redaction logic fails to apply the necessary masks, attackers can receive field values that the REST API would correctly withhold. Furthermore, because the server permits subscription filtering based on these fields, an attacker can use the unmasked values to query, filter, or watch objects that they should not have visibility into, facilitating unauthorized data scraping and surveillance of internal object states.\nAffected versions include Parse Server >= 9.0.0 before 9.10.1-alpha.8, and all versions prior to 8.6.89. The vulnerability is restricted to classes where LiveQuery is enabled and where protectedFields are configured for authenticated, role-based, or per-user groups. Masks defined under the 'public (*)' group remain unaffected and continue to function as intended, as the fallback logic erroneously treats all impacted requests as public."
}