BIT-PARSE-2026-100632 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply...

PT-2026-105127

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply...

Access Control Bypass

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Access Control Bypass via the LiveQuery subsystem in ParseLiveQueryServer.ts, which fails to load role memberships before...

CVE-2026-100632

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

EUVD-2026-87726

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

CVE-2026-100632

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

CVE-2026-100632

The Parse Server open-source backend server (versions >= 9.0.0 and < 9.10.1-alpha.8 , and versions

CVE-2026-100632: Exposure of Sensitive Information to an Unauthorized Actor

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

PT-2026-99303

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.1-alpha.7 Parse Server versions prior to 8.6.89 Description LiveQuery evaluates the protectedFields class-level permission using an incompletely resolved caller identity. Because subscriber roles are no...

CVE-2026-53726: Authorization Bypass Through User-Controlled Key

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting clie...

CVE-2026-39381

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any...

CVE-2026-39381: Incorrect Authorization

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any...

CVE-2026-34595

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By...

CVE-2026-34595: Access of Resource Using Incompatible Type

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By...