The flaw resides in the file metadata endpoint of Parse Server, where the beforeFind and afterFind triggers are not enforced for GET /files/:appId/metadata/:filename requests. This bypass allows an unauthenticated user to retrieve metadata for any file regardless of the access-control logic encoded in the triggers, exposing potentially sensitive information such as filenames, sizes, or storage location. The weakness is characterized as an unauthorized access flaw (CWE-862).

Parse Server versions earlier than 8.6.9 and 9.5.0-alpha.9 are impacted, regardless of the underlying operating system or infrastructure, provided Node.js is available. The vulnerability is tied to the open-source backend code maintained by the parse-community project.

The CVSS v3 score of 6.3 indicates a medium severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, which further reduces immediate threat. An attacker must know the target appId and filename to trigger the endpoint, but no additional authentication is required, so the attack vector is effectively remote and directly exploitable by issuing a crafted HTTP GET request. The lack of trigger enforcement can lead to exposure of file metadata but does not directly grant file content access.