BIT-PARSE-2026-116161 Parse Server 9.0.0 before 9.10.5 LiveQuery Information Disclosure via $or Subscriptions

Parse Server before 8.6.103 and 9.0.0 before 9.10.5 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together...