Parse Server 9.7.0 through 9.10.5-alpha.9 contains an authorization flaw that causes object‑ID based installation updates to be applied to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, an attacker who knows another installation’s object ID can trigger a beforeSave hook that processes that installation’s protected fields while writing to a different installation. This flaw allows the attacker to manipulate protected data through the trigger mechanism.

The vulnerability affects the parse-community Parse Server product, specifically versions 9.7.0 up to (but not including) 9.10.5-alpha.10.

The CVSS score of 6.3 indicates a medium severity risk. EPSS data are not available and the flaw is not listed in the CISA KEV catalog, implying no known widespread active exploitation. The attack vector is likely remote via the Parse Server API; an attacker must know a valid installation object ID and have protectedFieldsTriggerExempt enabled. Under these conditions the vulnerability can be exploited to gain unauthorized access to protected fields.