Parse Server allows an attacker who only knows the public application ID to supply non-string values for installation fields, causing the server to inject query operators into the deduplication cleanup. The cleanup runs with elevated privileges before class‑level permissions are enforced, so the attacker can delete every device registration or a chosen subset. Deleted registrations cannot be recovered on the server, resulting in loss of push notification capability until clients re‑register. This defect is a data tampering, integrity, and availability issue that can be exploited without credentials.

The vulnerability affects the open‑source Parse Server from the parse-community vendor, in all versions prior to 8.6.90 and in versions from 9.0.0 up to (but not including) 9.10.1‑alpha.9. Any deployment that exposes the REST API to clients and uses push notifications is impacted in its default configuration.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is the publicly exposed REST API, where an unauthenticated attacker can send malicious payloads. Because no authentication or master key is required, the risk is high for any application that accepts external installation data.