CVE-2020-15270: parse-server - Receiving Subscription Objects with Deleted Session
Summary
CVE-2020-15270: receiving subscription objects with deleted session. Affects parse-server versions < 4.4.0. Fixed in 4.4.0. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2020-15270 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
parse-server is an open-source backend framework that allows developers to build scalable and customizable applications. It provides a set of APIs and tools for managing data, user authentication, and push notifications. The vulnerability in parse-server allows users with deleted sessions to still receive subscription objects, potentially leading to unauthorized access or data leakage.
Vulnerability Detail
The vulnerability arises from a caching issue in parse-server and Parse Live Query. When a session token is deleted, the Live Query Server fails to detect the deletion and continues to allow the user to receive subscription objects. This can occur even if the client is unable to create new objects, as Parse restricts this action. The caching mechanism in place for session tokens has two separate caches, one at the parse-server level and another at the Parse Live Query level. However, there are several problems with these caches: cacheTTL and cacheTimeout options have no effect on the Live Query Server, and the default cacheTimeout is set to 1 hour instead of the documented 30 days. As a result, clients using the old session token can still receive events for up to 1 hour after the token was invalidated.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.0
This is the first release that contains the fix.
npm install parse-server@4.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading parse-server is not immediately feasible, a temporary workaround is to manually clear the cache for session tokens in the Live Query Server. This can be done by restarting the Live Query Server or implementing a mechanism that periodically checks if a session exists. However, this workaround is not recommended as it may introduce additional complexity and potential performance issues.
Conclusion
The vulnerability in parse-server allows users with deleted sessions to still receive subscription objects, potentially leading to unauthorized access or data leakage. It is crucial to update parse-server to version 4.4.0 or later to fix this issue. If immediate upgrading is not possible, manually clearing the cache or implementing a session existence check can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
parse-server is an open-source backend framework that provides APIs and tools for building scalable applications.
Parse Live Query is a feature of parse-server that enables real-time data updates and subscriptions.
The vulnerability allows users with deleted sessions to still receive subscription objects, potentially leading to unauthorized access or data leakage.
The recommended solution is to update parse-server to version 4.4.0 or later, which includes fixes for the caching issue.
A temporary workaround is to manually clear the cache for session tokens in the Live Query Server, but this is not recommended due to potential complications and performance issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
