Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_confirm
https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg
Patch x_refsource_misc
https://github.com/parse-community/parse-server/pull/9317
Patch x_refsource_misc
https://github.com/parse-community/parse-server/pull/9318
Scores
CVSS v3
8.1
EPSS
0.0038
EPSS Percentile
59.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-285
CWE-863
Status
published
Products (3)
npm/parse-server
0 - 6.5.9npm
parseplatform/parse-server
< 6.5.9
parseplatform/parse_server
< 6.5.9
Published
Oct 04, 2024
Tracked Since
Feb 18, 2026