Parse Server allows unauthenticated access to the internal _GraphQLConfig and _Audience classes through the generic /classes/_GraphQLConfig and /classes/_Audience REST API routes. This bypasses the master key enforcement that is present on dedicated endpoints, enabling an attacker to read, modify, or delete GraphQL configuration and push audience data without any credential. The flaw represents an authorization bypass vulnerability (CWE-862) that can compromise the integrity and confidentiality of application configuration and push notification audiences.

The vulnerability affects Parse Server versions prior to 8.6.25 and 9.5.2-alpha.12, including all 9.5.2-alpha releases up to alpha.11 and any 8.6.x release below 8.6.25. Users running Parse Server on Node.js should verify that they are not using these affected releases.

With a CVSS score of 8.8 the flaw is considered high severity. The EPSS score is below 1%, indicating low exploitation probability at the time of this analysis, and it is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability by issuing HTTP requests to the exposed generic class routes, which do not require authentication or the master key. The attack path is straightforward for anyone with network access to the Parse Server instance.