5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34595

CVE-2026-34595: Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value. This issue has been patched in versions 8.6.70 and 9.7.0-alpha.18.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34595

CVE-2026-34595:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.7.0-alpha.16	9.7.0-alpha.16
parse-server	npm	< 8.6.70	8.6.70

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-mmg8-87c5-jrc2, allows an authenticated user to bypass protectedFields in Parse Server's LiveQuery subscriptions. The root cause is a type confusion vulnerability where the server does not properly validate the data type of values for logical query operators ($or, $and, $nor). The system expected an array but would also process an 'array-like' object (a plain object with numeric keys and a length property).

My analysis of the provided patches (commits f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98 and ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2) confirms this. The changes consistently add Array.isArray() checks in multiple locations where these logical operators are processed.

The identified vulnerable functions are the key points where this lack of validation occurred:

_UnsafeRestQuery.denyProtectedFields: This is a primary security gate for protecting fields in standard queries. The missing validation allowed this gate to be bypassed.
ParseLiveQueryServer._validateQueryConstraints: This function is specific to LiveQuery and is responsible for validating the query structure. It was missing the type check for logical operators.
ParseLiveQueryServer._makeLiveQuerySubscription: This function, which sets up the subscription, contained nested logic (checkWhere and checkDepth) that also failed to validate the operator values, providing another vector for the same vulnerability.
matchesKeyConstraints: As a defense-in-depth measure, this lower-level query evaluation function was also patched to reject non-array values for logical operators, preventing the query from matching incorrectly even if other guards failed.

An attacker exploiting this vulnerability would cause these functions to be called with a malicious, non-array query object, leading to the bypass of protected field restrictions.

Vulnerable functions

ParseLiveQueryServer._validateQueryConstraints

src/LiveQuery/ParseLiveQueryServer.ts

This function validates query constraints. The vulnerability lies in the fact that it did not check if the value of logical operators like `$or`, `$and`, or `$nor` was an array. An attacker could send an array-like object instead of an array to bypass protected-field guards. The patch adds a validation to ensure these operator values are arrays.

matchesKeyConstraints

src/LiveQuery/QueryTools.js

This function matches an object against query constraints. It was vulnerable because it did not validate that the constraints for `$or`, `$and`, and `$nor` operators were arrays. This allowed an attacker to use an array-like object to bypass the check. The patch adds a check to return false if the constraints are not an array.

_UnsafeRestQuery.denyProtectedFields

src/RestQuery.js

This function is supposed to prevent queries from accessing protected fields. The vulnerability is that it did not validate the type of the value for logical operators like `$or`, `$and`, and `$nor`. By sending an array-like object, an attacker could bypass this protected-field guard. The patch adds a check to ensure the value is an array.

ParseLiveQueryServer._makeLiveQuerySubscription

src/LiveQuery/ParseLiveQueryServer.ts

This function creates a LiveQuery subscription. Within this function, the logic for checking query depth (`checkDepth`) and query conditions (`checkWhere`) was vulnerable. It did not validate that the values for `$or`, `$and`, and `$nor` operators were arrays, allowing an attacker to use an array-like object to bypass security checks. The patch adds this validation before processing subqueries.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.