CVE-2026-116161

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.103 Parse Server versions 9.0.0 through 9.10.5-alpha.3

Description An information disclosure issue exists in LiveQuery. The subscription hash fails to include constraints adjacent to a $or operator, such as the Session owner filter and beforeSubscribe constraints, causing distinct subscriptions to be grouped together. Consequently, authenticated clients using $or queries can receive events belonging to other users, which may include session tokens that can be used for impersonation.

Recommendations Update Parse Server to version 8.6.103 or later. Update Parse Server to version 9.10.5-alpha.4 or later.