parse-server: LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens

Impact

Parse Server's LiveQuery groups the subscriptions of a class by a hash of the subscription query and delivers each event once per group, matched against the first subscriber's query. The hash leaves out query constraints that sit next to a $or operator, including constraints that Parse Server adds on the server side: the owner filter applied to _Session subscriptions and any constraint added by a beforeSubscribe trigger. Two subscriptions that differ only in those constraints are treated as the same subscription, so a client can receive events meant for another client. Access controlled by ACL, class-level permissions, or protected fields is still enforced per client; only isolation that exists solely in the query constraints is lost. When a _Session subscription is affected, the events a client receives can include another user's session token, which can then be used to act as that user. Applications that use LiveQuery with $or in subscription queries and rely on query constraints for isolation are affected, including _Session subscriptions and subscriptions whose isolation is added by a beforeSubscribe trigger.

Patches

The subscription hash is now derived from the complete subscription query rather than only the $or branches, so constraints next to $or — including the server-added _Session owner filter and beforeSubscribe constraints — are part of the hash. Subscriptions whose queries differ in those constraints are no longer grouped together, so each client receives only the events its own query matches.

Workarounds

Protect sensitive classes with ACL or class-level permissions rather than relying only on query constraints for isolation. For the _Session class in particular, avoid subscribing with a $or query. More generally, avoid $or in subscription queries whose isolation depends on constraints placed next to the $or. Upgrading to a patched version is the recommended remediation.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-349r-988w-x3jp
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10776
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10777