Parse Server LiveQuery Class-Level Permission Bypass Vulnerability

A vulnerability exists in Parse Server versions 9.0.0 prior to 9.5.2-alpha.3 and versions prior to 8.6.16, where class-level permissions (CLP) are not properly enforced for LiveQuery subscriptions. This flaw allows unauthenticated or unauthorized clients to subscribe to any LiveQuery-enabled class and receive real-time updates for all objects, bypassing CLP restrictions. As a result, data meant to be protected by CLP is exposed to unauthorized subscribers in real time.

Impact

Exploitation of this vulnerability leads to a bypass of class-level permissions in LiveQuery, allowing unauthorized access to real-time data updates that should be restricted.

Remediation

Users can update to Parse Server versions 9.5.2-alpha.3 or 8.6.16, where this vulnerability has been patched. Alternatively, LiveQuery can be disabled for classes that use CLP restrictions by removing them from the 'liveQuery.classNames' server configuration.