CVE-2026-33163: Parse Server - Leakage of Protected Fields via LiveQuery afterEvent Trigger
Summary
CVE-2026-33163: Parse Server leaks protected fields via LiveQuery afterEvent trigger. Affects parse across 2 version ranges.
< 8.6.50
>= 9.0.0, < 9.6.0
Fixed in 8.6.50 or 9.6.0, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-33163 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that allows developers to build applications on any infrastructure that supports Node.js. It provides features such as data storage, user authentication, and real-time notifications through LiveQuery. However, it is susceptible to vulnerabilities that can expose sensitive user data if not properly managed.
Vulnerability Detail
The vulnerability arises from a bug in the handling of LiveQuery events when an afterEvent trigger is registered. Specifically, the LiveQuery server inadvertently leaks protected fields and authData to all subscribers of a class, including sensitive information such as personal data and OAuth tokens. This occurs because the sensitive data filter is applied to the Parse.Object reference, but the unfiltered JSON copy is sent to clients. As a result, users with sufficient Class-Level Permissions (CLP) can access protected data of other users, leading to potential data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.508.6.50 -
>= 9.0.0, < 9.6.09.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can remove all registrations of the Parse.Cloud.afterLiveQueryEvent trigger. This will prevent the reference detachment from occurring, ensuring that protected fields are filtered correctly. You can do this by commenting out or deleting the trigger registration code in your cloud functions.
Conclusion
CVE-2026-33163 is a significant vulnerability in Parse Server that can lead to the exposure of sensitive user data through LiveQuery events. It is crucial for developers to update their Parse Server versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for parse →
FAQ
CVE-2026-33163 is a vulnerability in Parse Server that allows the leakage of protected fields via LiveQuery afterEvent triggers.
Protected fields are sensitive data fields that are restricted from being accessed by unauthorized users based on Class-Level Permissions (CLP).
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update your Parse Server version, you should remove all afterEvent trigger registrations as a temporary workaround to prevent data leakage.
The consequences include unauthorized access to sensitive user data, which can lead to data breaches, privacy violations, and loss of user trust.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
