Parse Server versions prior to 9.10.2-alpha.5 share transactional batch state across concurrent requests, allowing one client’s transactional batch operation to interfere with another client’s database writes. If a batch fails, acknowledged writes from other clients are rolled back, and open PostgreSQL transactions may persist indefinitely, causing subsequent writes to fail. This flaw compromises data integrity, enabling an attacker to force data loss or corruption through crafted batch requests.

The flaw affects Parse Server (parse-community:parse-server). Vulnerable releases include Parse Server 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2‑alpha.4. Administrators of these versions should verify the deployed release number and assess whether the server is exposed to the public.

The CVSS score of 8.3 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based, requiring an attacker to send concurrent transactional batch requests to a Parse Server instance that shares state between client sessions. Successful exploitation would require an attacker to maintain at least two active batch requests; the flaw permits the attacker to cause other clients’ writes to be rolled back, though it does not enable arbitrary code execution or direct privilege escalation.