Parse Server's custom object ID allows to acquire role privileges

Description

If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 7.0.0, < 7.3.0

  < 6.5.9**

• Patched version(s): **7.3.0

  6.5.9**

References

• GHSA-8xq9-g7ch-35hg
• CVE-2024-47183
• CWE-285
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability - CVE-2024-39309
• parse-server's session object properties can be updated by foreign user if object ID is known - CVE-2022-39225
• Parse Server allows public `explain` queries which may expose sensitive database performance information and schema deta - CVE-2025-64502
• ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection - CVE-2024-27298

Tags:

npm

parse-server