Parse Server's LiveQuery bypasses CLP pointer permission enforcement
Impact
Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and pointerFields). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user. This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is correctly restricted via the REST API.
Patches
The LiveQuery server now enforces pointer permissions on each event. After the existing check passes (which defers pointer permissions by design), the fix checks whether any configured pointer field on the object points to the subscribing user. Events for objects that don't match are silently skipped, consistent with how ACL mismatches are handled.
Workarounds
Use ACLs on individual objects to restrict read access instead of relying solely on CLP pointer permissions. ACLs are enforced by LiveQuery.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | parse-server | >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 | 9.6.0-alpha.42, 8.6.53 |
Referencias
- https://github.com/parse-community/parse-server/security/advisories/GHSA-fph2-r4qg-9576
- https://nvd.nist.gov/vuln/detail/CVE-2026-33421
- https://github.com/parse-community/parse-server/pull/10250
- https://github.com/parse-community/parse-server/pull/10252
- https://github.com/parse-community/parse-server/commit/6c3317aca6eb618ac48f999021ae3ef7766ad1ea
- https://github.com/parse-community/parse-server/commit/976dad109f3fe3fbd0a3a35ef62e7a5d35eb0bee
- https://github.com/parse-community/parse-server
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-863- Plataforma
- npm
- Paquete
parse-server- Publicada
- 20.03.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-fph2-r4qg-9576 - CC BY 4.0
Historial de vulnerabilidades: parse-server
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 116
- Primera → última
- 06.2019 06.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 17
- Alta 49
- Media 40
- Baja 10
Divulgaciones por año
- 2019: 2
- 2020: 4
- 2021: 4
- 2022: 12
- 2023: 5
- 2024: 4
- 2025: 6
- 2026: 79
-
Parse Server's LiveQuery bypasses CLP pointer permission enforcement esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.