Parse Server CVE-2026-100632

Requires an authenticated Parse Server account plus a specific server configuration: the target class must have LiveQuery enabled AND define protectedFields under a role: group, the authenticated group, or a per-user group. Classes whose masks are defined only under the public (*) group are NOT affected because those masks are applied correctly. Exploitation is triggered when the subscriber does not supply its own session token (redaction falls back to an anonymous identity) and because subscriber roles are never resolved. Limiting factors: authenticated access is needed (PR:L), the vulnerable protectedFields/LiveQuery configuration is non-default, and only the fields defined in those role/authenticated/per-user masks are exposed - not arbitrary data. Mitigable without patching by additionally defining the masks under public (*) or disabling LiveQuery for the affected classes.

This is a genuine but access-gated information-disclosure flaw, best characterized as a real-but-moderate priority rather than an urgent one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent with the description: network-reachable, low-complexity, requires an authenticated subscriber (PR:L), confidentiality-only impact. The VC:H rating is defensible because protectedFields exist specifically to hide sensitive fields, but it is somewhat generous - only a defined subset of fields for role/authenticated/per-user CLP groups leaks, not the entire record, and public(*) masks still apply correctly. No EPSS score, no CISA KEV entry, and no public exploit code were provided; there is no public exploit identified at time of analysis, so exploitation is not confirmed. The most important limiting signal is not in the numeric score: exploitation requires a non-default deployment where LiveQuery is enabled AND protectedFields are configured under role:/authenticated/per-user groups. That configuration dependency, combined with the requirement for an authenticated Parse account, means real-world exposure is narrower than the 7.1 suggests. No conflicting data across sources was observed - the single VulnCheck advisory and the vendor GHSA agree.

An attacker who holds a legitimate authenticated account on a Parse Server app subscribes via LiveQuery to a class whose protectedFields mask is defined under a role, the authenticated group, or a per-user rule - and either supplies no session token or relies on the fact that their roles are never resolved. The server authorizes the underlying read against the connected user but redacts the pushed event payload against an anonymous identity, so the role/user/authenticated field mask is never applied and the subscriber receives field values the REST API would withhold, and can even filter or watch subscriptions on those masked fields. No public exploit code is known.