The LDAP authentication adapter in Parse Server until versions 9.5.2-alpha.13 and 8.6.26 concatenates unescaped user input into LDAP Distinguished Names and group search filters. This creates an injection vector that allows an authenticated attacker to alter the bind DN or group membership checks. The attacker can then force a bind or group query that lists the user as a member of any protected group, effectively elevating privileges within the application.

Parse Server (parse-community:parse-server) deployments that employ the LDAP authentication adapter with group‑based access control. Any configuration using LDAP before the patched releases—specifically before 9.5.2-alpha.13 and 8.6.26—contributes to the vulnerability. Systems still running earlier major or minor releases are also affected.

The weakness carries a CVSS score of 6, indicating moderate severity. Exploit probability is very low, with an EPSS below 1%, and the vulnerability is not catalogued in the CISA KEV list. Exploitation requires possession of valid LDAP credentials, so the attack is limited to authenticated users. The primary risk is privilege escalation to restricted groups, which could lead to unauthorized access to protected resources.