CVE-2026-116161
Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure…
- Risk score
- 40/100
- CVSS
- 6.0 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 25 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated c…
- Affected
- See advisory
- Fix
- Upgrade the product to 8.6.103, 9.0.0 or 9.10.5 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.0 medium
References
Original description
Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.
Last activity 25 Oct 2026. Patch Forecast updates every hour.