{"id":"CVE-2026-116161","title":"Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions","summary":"Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubs…","severity":"medium","cvss":6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-200"],"vendor":"parse-community","product":"parse-server","affected":["parse-server >= 9.0.0 < 9.10.5-alpha.4","parse-server < 8.6.103"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T13:20:06.298Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116161","references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp","label":"GitHub Security Advisory (GHSA-349r-988w-x3jp)"},{"url":"https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.4-livequery-information-disclosure-via-or-subscriptions","label":"VulnCheck Advisory: Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions"}],"tags":["cve.org"],"ingestedAt":"2026-10-25T22:08:29.949Z","slug":"CVE-2026-116161","body":"## Overview\n\nParse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.\n\n## Affected\n\n- `parse-server >= 9.0.0 < 9.10.5-alpha.4`\n- `parse-server < 8.6.103`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}