VULNERABILITY INTELLIGENCE
CVE-2026-116161
EPSS probability0.29%
CISA KEVNot currently listed
Published2026-10-25
Last modified2026-10-29
Description
Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.
Weakness classification
- disclosure@vulncheck.com: CWE-200