VDB
KO
HIGH

GHSA-7ch5-98q2-7289

Parse Server has a bypass of class-level permissions in LiveQuery

Details

### Impact

Class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any LiveQuery-enabled class and receive real-time events for all objects, regardless of CLP restrictions.

All Parse Server deployments that use LiveQuery with class-level permissions are affected. Data intended to be restricted by CLP is leaked to unauthorized subscribers in real time.

### Patches

The fix enforces CLP before creating the subscription and during event delivery.

### Workarounds

Disable LiveQuery for classes that use CLP restrictions by removing them from the `liveQuery.classNames` server configuration.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.16

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / parse-server
Introduced in: 9.0.0 Fixed in: 9.5.2-alpha.3
Fix npm install parse-server@9.5.2-alpha.3
npm / parse-server
Introduced in: 0 Fixed in: 8.6.16
Fix npm install parse-server@8.6.16

References