Parse Server EUVD-2026-109422

Exploitation requires: (1) an authenticated Parse Server client (PR:L); (2) the application using LiveQuery with a $or operator in its subscription query; and (3) reliance on query constraints sitting next to that $or for isolation - specifically the server-added owner filter on _Session subscriptions, or a constraint injected by a beforeSubscribe trigger. A second (victim) client must be concurrently subscribed to the same class such that its subscription is grouped with the attacker's by the flawed hash (reflected as AT:P). LIMITING FACTORS: isolation enforced by ACL, class-level permissions, or protected fields is still applied per client and is NOT bypassed - only isolation that exists solely in query constraints is lost; the attacker must already be authenticated; and only affected Parse Server versions (>=9.0.0 <9.10.5-alpha.4, and <=8.6.102) are vulnerable.

This is a credible but conditional priority, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H) shows a network-reachable, low-complexity flaw that nonetheless requires authentication (PR:L) and carries an attack requirement (AT:P) - consistent with the vendor description, which depends on another user concurrently holding a subscription that gets grouped with the attacker's. Confidentiality impact is high because leaked _Session events can contain session tokens usable for impersonation, which effectively escalates a read into account takeover; integrity and availability base impacts are none. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied - only vendor/coordinator advisories (GitHub GHSA and VulnCheck). The vuln.today decision label is 'this_month' and a patch is available, which aligns with a real-but-targeted rather than mass-exploited profile. Key missing signals: EPSS probability is absent so widespread automated exploitation cannot be estimated, and no working PoC is confirmed. Net: a genuine issue for anyone running LiveQuery with $or subscriptions and relying on query constraints for isolation, meriting prompt patching this cycle, but gated by the authenticated-plus-concurrent-victim precondition.

An authenticated client opens a LiveQuery subscription on the _Session class (or a class whose isolation is added by a beforeSubscribe trigger) using a $or query. Because the subscription hash omits the server-added owner filter sitting next to the $or, the attacker's subscription is grouped with another user's, and the attacker begins receiving that user's events - including session tokens - which can then be replayed to impersonate the victim. No public exploit identified at time of analysis; exploitation requires a valid client session and a victim with a matching grouped subscription (AT:P).