CVE-2026-57481 — parse-server
Fix: parse-community/parse-server@c9b24ceCVE-2026-57481 is a Information Exposure vulnerability in parse-server. A fix is available for parse-server — see the affected versions and patch details below.
Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-57481.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
parse-servernpmDescription
Impact
A Parse Server LiveQuery subscriber can receive object field values they are not authorized to read when a single save changes both an object field and the subscriber's ACL read access to that object. When such a save removes the subscriber's read access, the resulting leave event still carries the post-update object body, disclosing the new field values the subscriber is no longer permitted to read. The symmetric case applies to the enter event: when a save grants read access, the event includes the pre-grant object state the subscriber was not previously permitted to read. The disclosure is bounded to the single object affected by that save and is delivered only to the subscriber whose access changed. Applications that combine content changes with access-control changes in the same save on LiveQuery-enabled classes are affected.
Patches
Parse Server now verifies the subscriber's authorization for the specific object state included in leave and enter events. For a leave caused by the subscriber losing read access, the event delivers the last object state the subscriber was authorized to see instead of the post-update body. For an enter caused by the subscriber gaining read access, the previously unauthorized original object state is omitted. Events caused by a normal query-match change, where the subscriber keeps read access, are unaffected, as are master-key subscribers.
Workarounds
Do not change an object's field values and a subscriber's ACL read access in the same save on LiveQuery-enabled classes; perform the access-control change in a separate save before or after the content change. Alternatively, limit which classes are enabled for LiveQuery.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | parse-server | ≥ 9.0.0&&< 9.9.1-alpha.13 | 9.9.1-alpha.13npm install parse-server@9.9.1-alpha.13 |
| 📦npm | parse-server | all versions | 8.6.83npm install parse-server@8.6.83 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for parse-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update parse-server to 9.9.1-alpha.13 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-57481 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
Frequently Asked Questions
Is CVE-2026-57481 in your dependencies?
Find it across npm, including transitive dependencies.