---
id: "CVE-2026-116161"
kind: "vulnerability"
aliases: ["CVE-2026-116161"]
title: "Parse Server: LiveQuery subscriptions with $or leak other users' events"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["livequery", "node", "package", "parse-server", "self-hosted"]
not_affected_if: ["livequery-disabled", "no-authenticated-clients"]
published_at: "2026-10-25T14:16:54+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:42:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116161", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# Parse Server: LiveQuery subscriptions with $or leak other users' events

Parse Server's LiveQuery groups distinct subscriptions together when they use a $or query, because the subscription hash leaves out some constraints. An authenticated client can therefore receive other users' events, including session tokens that can be used to impersonate those users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed parse-server version with `npm ls parse-server` and compare it to the fixed versions.
- Confirm whether LiveQuery is enabled in the server configuration (liveQuery option).

## Fix

- Upgrade parse-server to `8.6.103` or later on the 8.x line.
- Upgrade parse-server to `9.10.5-alpha.4` or later on the 9.x line.

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116161

## From the sources

Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_