CVE-2026-30947

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30947
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any LiveQuery-enabled class and receive real-time events for all objects, regardless of CLP restrictions. All Parse Server deployments that use LiveQuery with class-level permissions are affected. Data intended to be restricted by CLP is leaked to unauthorized subscribers in real time. This vulnerability is fixed in 9.5.2-alpha.3 and 8.6.16.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/releases/tag/8.6.16 Product Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3 Product Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 Mitigation Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha2:*:*:*:node.js:*:*
History

11 Mar 2026, 17:15

Type Values Removed Values Added
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha2:*:*:*:node.js:*:*
First Time Parseplatform
Parseplatform parse-server
References () https://github.com/parse-community/parse-server/releases/tag/8.6.16 - () https://github.com/parse-community/parse-server/releases/tag/8.6.16 - Product, Release Notes
References () https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3 - () https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3 - Product, Release Notes
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 - () https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 - Mitigation, Patch, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

11 Mar 2026, 13:52

Type Values Removed Values Added
Summary
  • (es) Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 9.5.2-alpha.3 y 8.6.16, los permisos a nivel de clase (CLP) no se aplican para las suscripciones de LiveQuery. Un cliente no autenticado o no autorizado puede suscribirse a cualquier clase habilitada para LiveQuery y recibir eventos en tiempo real para todos los objetos, independientemente de las restricciones de CLP. Todas las implementaciones de Parse Server que utilizan LiveQuery con permisos a nivel de clase se ven afectadas. Los datos destinados a ser restringidos por CLP se filtran a suscriptores no autorizados en tiempo real. Esta vulnerabilidad está corregida en 9.5.2-alpha.3 y 8.6.16.

10 Mar 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 21:16

Updated : 2026-03-11 17:15

NVD link : CVE-2026-30947

Mitre link : CVE-2026-30947

CVE.ORG link : CVE-2026-30947

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-863

Incorrect Authorization