{"schema":"threatline.record/2","record":{"id":"GHSA-349r-988w-x3jp","aliases":["GHSA-349r-988w-x3jp"],"summary":"LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens","details":"### Impact\n\nParse Server's LiveQuery groups the subscriptions of a class by a hash of the subscription query and delivers each event once per group, matched against the first subscriber's query. The hash leaves out query constraints that sit next to a `$or` operator, including constraints that Parse Server adds on the server side: the owner filter applied to `_Session` subscriptions and any constraint added by a `beforeSubscribe` trigger. Two subscriptions that differ only in those constraints are treated as the same subscription, so a client can receive events meant for another client. Access controlled by ACL, class-level permissions, or protected fields is still enforced per client; only isolation that exists solely in the query constraints is lost. When a `_Session` subscription is affected, the events a client receives can include another user's session token, which can then be used to act as that user. Applications that use LiveQuery with `$or` in subscription queries and rely on query constraints for isolation are affected, including `_Session` subscriptions and subscriptions whose isolation is added by a `beforeSubscribe` trigger.\n\n### Patches\n\nThe subscription hash is now derived from the complete subscription query rather than only the `$or` branches, so constraints next to `$or` — including the server-added `_Session` owner filter and `beforeSubscribe` constraints — are part of the hash. Subscriptions whose queries differ in those constraints are no longer grouped together, so each client receives only the events its own query matches.\n\n### Workarounds\n\nProtect sensitive classes with ACL or class-level permissions rather than relying only on query constraints for isolation. For the `_Session` class in particular, avoid subscribing with a `$or` query. More generally, avoid `$or` in subscription queries whose isolation depends on constraints placed next to the `$or`. Upgrading to a patched version is the recommended remediation.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10776\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10777","categories":["Unclassified"],"product":"parse-server","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp","source_modified_at":"2026-10-10T21:08:01Z","fetched_at":"2026-10-26T12:48:13.248886Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 9.0.0, < 9.10.5-alpha.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp","source_modified_at":"2026-10-10T21:08:01Z","fetched_at":"2026-10-26T12:48:13.248886Z","package":{"ecosystem":"npm","name":"parse-server"},"range":"<= 8.6.102"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp","source_modified_at":"2026-10-10T21:08:01Z","fetched_at":"2026-10-26T12:48:13.248886Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"9.10.5-alpha.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp","source_modified_at":"2026-10-10T21:08:01Z","fetched_at":"2026-10-26T12:48:13.248886Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"8.6.103"}],"cvss":6,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-10T21:08:01Z","modified_at":"2026-10-10T21:08:01Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp","fetched_at":"2026-10-26T12:48:13.248886Z","source_modified_at":"2026-10-10T21:08:01Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-10T21:08:01Z","content_hash":"1455fd0b802b3984e8339a059ffdd5585eb44923c94773a74bc7a5b02f8663f6"}}