CVE-2026-57481 - CVSS, EPSS & CISA Kev 상세 정보 | CVE Find

CVE 설명

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.13 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL read access, because leave and enter events included the wrong object state. This issue is fixed in versions 9.9.1-alpha.13 and 8.6.83.

CVE 정보

관련 약점

CWE-ID	약점 이름	출처
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

참고 자료

https://github.com/parse-community/parse-server/commit/c9b24cecfee76d8563019adaacbcbd78471dc41e

https://github.com/parse-community/parse-server/commit/e9c85dfe40a866a55ebae3b6ae56285ac0a22e64

https://github.com/parse-community/parse-server/pull/10515

https://github.com/parse-community/parse-server/pull/10516

https://github.com/parse-community/parse-server/releases/tag/8.6.83

https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.13

https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8r