Parse Server allows an attacker with a readOnlyMasterKey to create or delete files through the Files API, violating the intended read‑only restriction. This enables an attacker to upload arbitrary files or erase critical files, compromising data integrity and availability.

Parse Server from parse-community is impacted; any release prior to 8.6.5 and 9.5.0‑alpha.3 that exposes the Files API and uses the readOnlyMasterKey is vulnerable.

The CVSS score is 6.9, indicating moderate severity, but the EPSS score is below 1% and it is not listed in KEV, suggesting low exploit probability. The vulnerability can be leveraged remotely by sending POST or DELETE requests to /files/:filename with the readOnlyMasterKey, provided the API is exposed. The attacker must have access to the key, so compromise or insufficient secrecy of the key are prerequisites.