CVE-2026-116161— Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Quick assessment

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 8.6.103 之前的 Parse Server，以及 9.0.0 至 9.10.5-alpha.4 之间的版本中，LiveQuery 组件存在信息泄露漏洞。其订阅哈希计算时遗漏了运算符旁边的约束条件，包括所有者过滤器和约束，导致本应不同的订阅被错误地归为一组。因此，使用查询进行订阅的已认证客户端可能会接收到其他用户的事件，其中包括可用于身份冒用的会话令牌（session tokens）。

CVSS 6.0 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 2 AI

T1086 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

Source: CVE Program / CVE List V5

Vulnerability Description

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
parse-community	parse-server	9.0.0 ~ 9.10.5-alpha.4	-
parse-community	parse-server	0 ~ 8.6.103	-

II. Public POCs for CVE-2026-116161

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116161

请登录查看更多情报信息。

Other References for CVE-2026-116161 (2)

https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp vendor-advisory
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.4-livequery-information-disclosure-via-or-subscriptions third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116161

Same Patch Batch · parse-community · 2026-10-25 · 5 CVEs total

CVE-2026-116165	8.8 HIGH	Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
CVE-2026-116163	7.4 HIGH	Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
CVE-2026-116164	6.3 MEDIUM	Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
CVE-2026-116162	2.1 LOW	Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

IV. Related Vulnerabilities

Same product: parse-server

Same vendor: parse-community

Same weakness: CWE-200