Is there a patch available for EUVD-2026-42422?

Yes, a patch is available for EUVD-2026-42422. Update the affected software to the latest version immediately.

Parse Server EUVD-2026-42422

Q: What is the CVSS score of EUVD-2026-42422?

EUVD-2026-42422 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-57481 LOW

Information Exposure (CWE-200)

2026-07-08 security-advisories@github.com

Information Disclosure Node.js

2.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Network-reachable LiveQuery endpoint but AC:H because exploitation requires a specific co-mutation (field and ACL changed in one save); PR:L for authenticated subscriber; only limited field-value disclosure.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 22:22 vuln.today

Patch available

Jul 08, 2026 - 22:04 EUVD

DescriptionCVE.org

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.

AnalysisAI

LiveQuery in Parse Server leaks unauthorized object field values to authenticated subscribers when a single save operation simultaneously modifies a sensitive field and the subscriber's ACL read access, because leave and enter events are built from the wrong object state. Affected deployments run parse-server below 8.6.83 (stable branch) or below 9.9.1-alpha.13 (v9 alpha branch) with LiveQuery enabled. The CVSS 4.0 score of 2.3 and AT:P prerequisite correctly reflect that exploitation is constrained to a specific co-mutation timing condition; no public exploit identified and no KEV listing exists at time of analysis.

Technical ContextAI

Parse Server is an open-source Node.js backend-as-a-service framework (npm: parse-server, github: parse-community/parse-server) providing REST, GraphQL, and real-time WebSocket subscriptions via its LiveQuery engine. LiveQuery pushes 'enter', 'leave', 'create', 'update', and 'delete' events to subscribed clients as Parse Objects match or unmatch a query. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies: when a single save() call atomically modifies both a field value and the ACL (Access Control List) that governs the subscriber's read permission on the object, the server incorrectly assembles the event payload - attaching object state from the wrong side of the ACL boundary. The result is that the field value visible only after the save (or only before it) is transmitted to a subscriber who, under the correct ACL state, should not receive it. The flaw is entirely within the LiveQuery event-diffing logic on the server side and does not require any client-side exploit code.

RemediationAI

Upgrade to Parse Server 8.6.83 (stable) or 9.9.1-alpha.13 (v9 alpha) as documented in the GitHub releases at https://github.com/parse-community/parse-server/releases/tag/8.6.83 and https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.13. The fixes are delivered via commits c9b24cecfee76d8563019adaacbcbd78471dc41e and e9c85dfe40a866a55ebae3b6ae56285ac0a22e64 (PRs #10515 and #10516). If immediate upgrade is not possible, split any save operations that would simultaneously change sensitive object fields and ACL read permissions into two sequential saves - update the ACL in one call, then update the field in a subsequent call (or vice versa), eliminating the co-mutation window that triggers the incorrect event state. The trade-off is slightly increased write latency and a brief consistency gap between the two saves during which the object may be in a partially updated state; application logic must tolerate this transient state.