GHSA-7ch5-98q2-7289
Parse Server has a bypass of class-level permissions in LiveQuery
Details
### Impact
Class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any LiveQuery-enabled class and receive real-time events for all objects, regardless of CLP restrictions.
All Parse Server deployments that use LiveQuery with class-level permissions are affected. Data intended to be restricted by CLP is leaked to unauthorized subscribers in real time.
### Patches
The fix enforces CLP before creating the subscription and during event delivery.
### Workarounds
Disable LiveQuery for classes that use CLP restrictions by removing them from the `liveQuery.classNames` server configuration.
### References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.16
Are you affected?
Enter the version of the package you're using.
Affected packages
9.0.0 Fixed in: 9.5.2-alpha.3 npm install parse-server@9.5.2-alpha.3 References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-30947 [ADVISORY]
- https://github.com/parse-community/parse-server [PACKAGE]
- https://github.com/parse-community/parse-server/releases/tag/8.6.16 [WEB]
- https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3 [WEB]