{"action":"Upgrade parse-server to 8.6.83 or later.","affected":[{"fixed":"9.9.1-alpha.13","introduced":"9.0.0"},{"fixed":"8.6.83","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-57481"],"ecosystem":"npm","epss":0.00527,"exploited":false,"fixed_versions":["9.9.1-alpha.13","8.6.83"],"ghsa_id":"GHSA-97pr-9hgg-3p8r","id":"tcs_01M5KFF4GY3K1FWRWSXT4C2Y8P","modified_at":"2026-07-14T16:40:56.037831743Z","published_at":"2026-06-19T21:42:48Z","references":["https://osv.dev/vulnerability/GHSA-97pr-9hgg-3p8r","https://github.com/parse-community/parse-server/security/advisories/GHSA-97pr-9hgg-3p8r","https://github.com/parse-community/parse-server/pull/10515","https://github.com/parse-community/parse-server/pull/10516","https://github.com/parse-community/parse-server"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-97pr-9hgg-3p8r","url":"https://osv.dev/vulnerability/GHSA-97pr-9hgg-3p8r"}],"summary":"parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change"}