Parse Server’s readOnlyMasterKey is intended to grant read‑only access, yet certain API endpoints incorrectly accept this key for mutating operations. An attacker who knows the key can create, modify, and delete Cloud Hooks and start Cloud Jobs, which can be used to exfiltrate data. This flaw is classified as CWE‑863 and results in unauthorized write privileges.

Any deployment of parse-community:parse-server that uses the readOnlyMasterKey option before the patches. Versions of Parse Server earlier than 8.6.4 and 9.4.1‑alpha.3 are affected. The flaw is present in all Node.js environments running those versions.

The vulnerability rates a CVSS score of 8.6, indicating high severity. The estimated exploitation probability is below 1 %, suggesting that current exploitation is uncommon, and it is not listed in CISA’s KEV catalog. Nevertheless, the attack vector requires knowledge of the readOnlyMasterKey, which could arise from credential compromise or insider misuse. Once exploited, the attacker gains the ability to alter deployment logic and potentially exfiltrate data, creating a high‑impact compromise with moderate likelihood of exploitation.