Parse Server has a bypass of class-level permissions in LiveQuery

Description

Class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any LiveQuery-enabled class and receive real-time events for all objects, regardless of CLP restrictions.

All Parse Server deployments that use LiveQuery with class-level permissions are affected.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **< 8.6.16

  >= 9.0.0, < 9.5.2-alpha.3**

• Patched version(s): **8.6.16

  9.5.2-alpha.3**

References

• GHSA-7ch5-98q2-7289
• CVE-2026-30947
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause - CVE-2026-32098
• Parse Server has a rate limit bypass via batch request endpoint - CVE-2026-30972
• Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery - CVE-2026-30925
• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728

Tags:

npm

parse-server