The vulnerability allows an attacker in possession of a readOnlyMasterKey to send a POST request to the /loginAs endpoint of Parse Server, causing the server to issue an authentication token for any specified user. The resulting token grants the attacker full read and write access to that user's data, thereby bypassing the intended partial‑read restriction of the key. This is a classic permission‑check bypass (CWE‑863).

All deployments of parse-community:parse-server that are running a version earlier than 8.6.6 or earlier than 9.5.0‑alpha.4 are affected. The flaw is independent of operating system or host, so any installation that uses the readOnlyMasterKey before these releases is vulnerable.

The vulnerability scores 8.5 on CVSS, reflecting a high severity, while the EPSS probability is less than 1 %, indicating that exploitation is currently unlikely but still feasible. The flaw is not listed in CISA’s KEV catalog. Because the attack is performed remotely by issuing an HTTP request to an exposed endpoint, an attacker who can obtain or compromise the readOnlyMasterKey can impersonate any user without requiring local access or additional credentials.