{"id":"CVE-2026-32098","summary":"Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause","details":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.9 and 8.6.35, an attacker can exploit LiveQuery subscriptions to infer the values of protected fields without directly receiving them. By subscribing with a WHERE clause that references a protected field (including via dot-notation or $regex), the attacker can observe whether LiveQuery events are delivered for matching objects. This creates a boolean oracle that leaks protected field values. The attack affects any class that has both protectedFields configured in Class-Level Permissions and LiveQuery enabled. This vulnerability is fixed in 9.6.0-alpha.9 and 8.6.35.","aliases":["BIT-parse-2026-32098","GHSA-j7mm-f4rv-6q6q"],"modified":"2026-04-02T13:24:15.887727Z","published":"2026-03-11T19:57:26.929Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32098.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-200"]},"references":[{"type":"WEB","url":"https://github.com/parse-community/parse-server/releases/tag/8.6.35"},{"type":"WEB","url":"https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32098.json"},{"type":"ADVISORY","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-j7mm-f4rv-6q6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32098"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/parse-community/parse-server","events":[{"introduced":"532a461d30a6ed4457839f2caf5f30d5abf51a55"},{"fixed":"e48c3b5173993f61842d77b6dc11f508601fd4c5"}]}],"versions":["9.0.0","9.1.0","9.1.0-alpha.1","9.1.0-alpha.2","9.1.0-alpha.3","9.1.0-alpha.4","9.1.1","9.1.1-alpha.1","9.2.0","9.2.0-alpha.1","9.2.0-alpha.2","9.2.0-alpha.3","9.2.0-alpha.4","9.2.0-alpha.5","9.2.1-alpha.1","9.2.1-alpha.2","9.3.0","9.3.0-alpha.1","9.3.0-alpha.2","9.3.0-alpha.3","9.3.0-alpha.4","9.3.0-alpha.5","9.3.0-alpha.6","9.3.0-alpha.7","9.3.0-alpha.8","9.3.0-alpha.9","9.3.1","9.3.1-alpha.1","9.3.1-alpha.2","9.3.1-alpha.3","9.3.1-alpha.4","9.4.0","9.4.0-alpha.1","9.4.0-alpha.2","9.4.1","9.4.1-alpha.1","9.4.1-alpha.2","9.4.1-alpha.3","9.5.0","9.5.0-alpha.1","9.5.0-alpha.10","9.5.0-alpha.11","9.5.0-alpha.12","9.5.0-alpha.13","9.5.0-alpha.14","9.5.0-alpha.2","9.5.0-alpha.3","9.5.0-alpha.4","9.5.0-alpha.5","9.5.0-alpha.6","9.5.0-alpha.7","9.5.0-alpha.8","9.5.0-alpha.9","9.5.1","9.5.1-alpha.1","9.5.1-alpha.2","9.5.2-alpha.1","9.5.2-alpha.10","9.5.2-alpha.11","9.5.2-alpha.12","9.5.2-alpha.13","9.5.2-alpha.14","9.5.2-alpha.2","9.5.2-alpha.3","9.5.2-alpha.4","9.5.2-alpha.5","9.5.2-alpha.6","9.5.2-alpha.7","9.5.2-alpha.8","9.5.2-alpha.9","9.6.0","9.6.0-alpha.1","9.6.0-alpha.10","9.6.0-alpha.11","9.6.0-alpha.12","9.6.0-alpha.13","9.6.0-alpha.14","9.6.0-alpha.15","9.6.0-alpha.16","9.6.0-alpha.17","9.6.0-alpha.18","9.6.0-alpha.19","9.6.0-alpha.2","9.6.0-alpha.20","9.6.0-alpha.21","9.6.0-alpha.22","9.6.0-alpha.23","9.6.0-alpha.24","9.6.0-alpha.25","9.6.0-alpha.26","9.6.0-alpha.27","9.6.0-alpha.28","9.6.0-alpha.29","9.6.0-alpha.3","9.6.0-alpha.30","9.6.0-alpha.31","9.6.0-alpha.32","9.6.0-alpha.33","9.6.0-alpha.34","9.6.0-alpha.35","9.6.0-alpha.36","9.6.0-alpha.37","9.6.0-alpha.38","9.6.0-alpha.39","9.6.0-alpha.4","9.6.0-alpha.40","9.6.0-alpha.41","9.6.0-alpha.42","9.6.0-alpha.43","9.6.0-alpha.44","9.6.0-alpha.45","9.6.0-alpha.46","9.6.0-alpha.47","9.6.0-alpha.48","9.6.0-alpha.49","9.6.0-alpha.5","9.6.0-alpha.50","9.6.0-alpha.51","9.6.0-alpha.52","9.6.0-alpha.53","9.6.0-alpha.54","9.6.0-alpha.55","9.6.0-alpha.56","9.6.0-alpha.6","9.6.0-alpha.7","9.6.0-alpha.8","9.6.0-alpha.9","9.6.1","9.6.1-alpha.1","9.7.0","9.7.0-alpha.1","9.7.0-alpha.10","9.7.0-alpha.11","9.7.0-alpha.12","9.7.0-alpha.13","9.7.0-alpha.14","9.7.0-alpha.15","9.7.0-alpha.16","9.7.0-alpha.17","9.7.0-alpha.18","9.7.0-alpha.2","9.7.0-alpha.3","9.7.0-alpha.4","9.7.0-alpha.5","9.7.0-alpha.6","9.7.0-alpha.7","9.7.0-alpha.8","9.7.0-alpha.9","9.7.1-alpha.1","9.7.1-alpha.2","9.7.1-alpha.3","9.7.1-alpha.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32098.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}