Information Disclosure Vulnerability in Parse Server by Parse Community

CVE-2026-116161

What is CVE-2026-116161?

The vulnerability in Parse Server arises from its handling of LiveQuery subscriptions, specifically when utilizing the $or operator. It allows authenticated clients to subscribe to queries without sufficient segregation, leading to the unintended exposure of other users' events, including session tokens. These tokens pose a risk of impersonation, as the lack of constraints, particularly the _Session owner filter, enables distinct subscriptions to be improperly grouped together. This could potentially lead to serious security breaches if not addressed promptly.

References