CyberRota Analysis
AI-GeneratedA vulnerability in Parse Server allows unauthorized LiveQuery subscribers to access object field values they should not be able to read due to incorrect handling of object state during save operations. This could lead to exposure of sensitive data, impacting applications that rely on this backend service. Organizations using affected versions should prioritize updating to versions 9.9.1-alpha.13 or 8.6.83 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.