Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116161Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Medium 6.0

In plain English

A medium-severity information exposure in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	9.0.0 – before 9.10.5-alpha.4
parse-community	parse-server	0 – before 8.6.103

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-349r-988w-x3jp) vendor-advisory
VulnCheck Advisory: Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions third-party-advisory