Parse Server allows clients to perform CRUD operations on internal tables that store role membership relations when only the publicly distributed application key is presented. Through this access an attacker can inject themselves into any existing Parse Role and thereby acquire all permissions tied to that role. This includes full read, write, and delete rights to any class that is protected by role‑based Class‑Level Permissions (CLP). Additionally, writing to tables that back Relation fields that are referenced in a __pointerFields__ CLP can bypass that access control entirely. The vulnerability is therefore a direct privilege escalation and CLP bypass that does not require a master key.

The issue affects Parse Server versions released before 9.5.2‑alpha.7 and 8.6.20, which are available from parse‑community. These are open‑source backend deployments built on Node.js that can run on any infrastructure. All customers running these versions are vulnerable.

The CVSS score of 10 signifies a critical security flaw. However, the EPSS score is <1%, indicating that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Despite the low projected exploitation probability, the attack vector—accessing internal tables over the public REST or GraphQL API with an application key—is simple and requires no special privileges. An attacker with knowledge of the application key can readily perform the necessary operations, making the risk high for those environments where the application key is exposed or used by untrusted clients. The risk remains elevated until a patch is applied or a proper mitigative configuration is implemented.