Listen to this Post
How the CVE Works
The vulnerability resides in Parse Server’s LiveQuery feature, which allows real-time subscriptions to queries. When a class has `protectedFields` configured, certain fields should be hidden from users even if they have `find` permission.
An authenticated attacker with `find` class-level permission can circumvent this guard by crafting a LiveQuery subscription. Instead of sending a standard array for logical operators ($or, $and, $nor), the attacker supplies a plain JavaScript object that mimics an array (numeric keys and a `length` property).
Parse Server’s validation logic did not strictly enforce that these operator values must be arrays. The malformed object passes the initial checks and reaches the protected‑field guard.
The guard then processes the query incorrectly, failing to redact the protected fields. As a result, the LiveQuery subscription fires events that include those protected fields when they match the test value.
By observing whether the subscription event is triggered (a binary oracle), the attacker can infer the value of a protected field, effectively exfiltrating sensitive data without direct read access.
The issue affects all Parse Server versions 8.6.70 and below, and 9.0.0 up to but not including 9.7.0-alpha.16.
The fix introduces explicit type checking: logical operator values must be arrays in the subscription handler, query depth checker, and protected‑field guard. As defense in depth, the LiveQuery evaluator also rejects non‑array values.
No workaround exists; upgrading is required.
DailyCVE Form
Platform: Parse Server
Version: <8.6.70, 9.0.0–<9.7.0-alpha.16
Vulnerability : Bypass protectedFields via array-like
Severity: Moderate
date: Apr 1, 2026
Prediction: Already patched
What Undercode Say:
Analytics
Check current Parse Server version npm list parse-server Upgrade to patched version (8.6.70 or 9.7.0-alpha.16) npm install [email protected] or npm install [email protected]
JavaScript test snippet to detect vulnerability
const subscription = {
query: {
$or: { 0: { protectedField: "targetValue" }, length: 1 } // array-like object
}
};
// If subscription succeeds and events contain protectedField, server is vulnerable
How Exploit:
- Identify a class with `protectedFields` and a `find` permission.
- Authenticate as a user who has `find` permission.
- Build a LiveQuery subscription where `$or` (or
$and/$nor) is an array‑like object with a numeric key andlength. - Set the inner condition to test a guessed value for a protected field.
- If a subscription event arrives, the guessed value is correct.
- Repeat with different guesses to brute‑force the protected field’s content.
Protection from this CVE
- Upgrade to Parse Server 8.6.70 or 9.7.0-alpha.16 or later.
- If immediate upgrade is impossible, restrict LiveQuery subscriptions at the network level (e.g., API gateway) to trusted users only.
- Monitor logs for subscriptions containing non‑array logical operators.
Impact
Information Disclosure – An authenticated attacker can infer values of protected fields (e.g., email, phone number, internal flags) by using the subscription event as a binary oracle. This bypasses the intended `protectedFields` restriction and undermines data confidentiality.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
