CVE-2026-57481: Parse-Community Parse-Server

Low severity, CVSS 2.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.

Affected products

• Parse-Community Parse-Server: from 9.0.0-alpha.1, before 9.9.1-alpha.13 (fixed in 9.9.1-alpha.13); before 8.6.83 (fixed in 8.6.83)

Published 2026-07-08. Last modified 2026-07-10.