8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30947

CVE-2026-30947: Parse Server has a bypass of class-level permissions in LiveQuery

Impact

Class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any LiveQuery-enabled class and receive real-time events for all objects, regardless of CLP restrictions.

All Parse Server deployments that use LiveQuery with class-level permissions are affected. Data intended to be restricted by CLP is leaked to unauthorized subscribers in real time.

Patches

The fix enforces CLP before creating the subscription and during event delivery.

Workarounds

Disable LiveQuery for classes that use CLP restrictions by removing them from the liveQuery.classNames server configuration.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.16

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30947

CVE-2026-30947:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.5.2-alpha.3	9.5.2-alpha.3
parse-server	npm	< 8.6.16	8.6.16

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows unauthorized access to LiveQuery data due to missing or incorrect Class-Level Permission (CLP) checks. The analysis of the patch identified two key vulnerable functions in src/LiveQuery/ParseLiveQueryServer.ts.

First, the ParseLiveQueryServer._handleSubscribe function, which processes new subscription requests, completely lacked a CLP check. This allowed any user, regardless of their permissions, to subscribe to any data class enabled for LiveQuery. The patch rectifies this by adding a call to SchemaController.validatePermission at the beginning of the function, ensuring that permissions are checked before a subscription is established.

Second, the ParseLiveQueryServer._matchesCLP function, which is called when data changes to determine if a subscriber should receive a real-time update, had a flawed implementation. It used a try...catch block that would catch permission validation errors from SchemaController.validatePermission and simply return false. This suppressed the error, and the calling functions (like _onAfterSave) did not correctly interpret the false return value as a denial, leading to unauthorized data being pushed to clients. The patch removes the try...catch block, allowing the permission error to propagate up the call stack, which correctly prevents the event from being delivered to unauthorized subscribers.

Therefore, an exploit would first involve a call to the vulnerable _handleSubscribe to create an unauthorized subscription. Subsequently, during event delivery for the subscribed class, the flawed logic in _matchesCLP would be triggered, leading to the data leak.

Vulnerable functions

ParseLiveQueryServer._handleSubscribe

src/LiveQuery/ParseLiveQueryServer.ts

This function is responsible for handling new LiveQuery subscription requests. Before the patch, it did not perform any Class-Level Permission (CLP) checks. This allowed any client, even unauthenticated ones, to subscribe to any class, bypassing security restrictions. The patch adds a CLP check using `SchemaController.validatePermission` before the subscription is created.

ParseLiveQueryServer._matchesCLP

src/LiveQuery/ParseLiveQueryServer.ts

This function is used during event delivery to check if a client's subscription should receive an event for a particular object. The original implementation caught exceptions from `SchemaController.validatePermission` and returned `false`. This behavior was incorrect and allowed events to be sent to unauthorized subscribers because the calling functions did not correctly handle the `false` return value. The fix removes the `try...catch` block, allowing the permission error to propagate, which correctly prevents the event from being sent.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.