PT-2026-24425 · Unknown · Parse Server

Restriction · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-30947

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.3 Parse Server versions prior to 8.6.16

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is susceptible to a flaw where class-level permissions (CLP) are not enforced for LiveQuery subscriptions. This allows unauthenticated or unauthorized clients to subscribe to any LiveQuery-enabled class and receive real-time events for all objects, bypassing CLP restrictions. Consequently, data intended to be restricted by CLP is exposed to unauthorized subscribers in real time. All Parse Server deployments utilizing LiveQuery with class-level permissions are potentially affected.

Recommendations Update to Parse Server version 9.5.2-alpha.3 or later. Update to Parse Server version 8.6.16 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-PARSE-2026-30947

CVE-2026-30947

GHSA-7CH5-98Q2-7289

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30947.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30947 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30947 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7ch5-98q2-7289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30947 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.16 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.3 · Note
• https://twitter.com/CVEnew/status/2031504126136193415 · Twitter Post