PT-2026-56607 · Unknown · Parse Server
CVE-2026-57481
·
Published
2026-06-19
·
Updated
2026-07-14
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Parse Server versions prior to 9.9.1-alpha.13
Parse Server versions prior to 8.6.83
Description
A LiveQuery subscriber may receive object field values they are not authorized to read. This occurs when a single save operation simultaneously modifies an object field and the subscriber's Access Control List (ACL) read permissions, causing leave and enter events to include an incorrect object state.
Recommendations
Update to version 9.9.1-alpha.13 or later.
Update to version 8.6.83 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Parse Server