CVE-2026-30947CWE-863

Parse Server ha a bypass of class-level permissions in LiveQuery

High · published March 10, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any LiveQuery-enabled class and receive real-time events for all objects, regardless of CLP restrictions. All Parse Server deployments that use LiveQuery with class-level permissions are affected. Data intended to be restricted by CLP is leaked to unauthorized subscribers in real time. This vulnerability is fixed in 9.5.2-alpha.3 and 8.6.16.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00484 · 40.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-10T20:16Z
EPSS history
Timeline
  • 10 MAR 20:16Z
    Parse Server ha a bypass of class-level permissions in LiveQuery
    cvelistv5