Parse Server’s PostgreSQL storage adapter is vulnerable to a SQL injection flaw when processing Increment operations on nested object fields (e.g., stats.counter). The "amount" value supplied by a client is interpolated directly into the generated SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL sub‑queries, enabling them to read any data stored in the underlying PostgreSQL database and bypass class‑level permissions (CLPs) and access control lists (ACLs). This constitutes a serious confidentiality breach and is classified as CWE‑89.

The affected product is Parse Server from parse-community. Versions prior to 8.6.29 and before the release of 9.6.0‑alpha.3 are impacted. MongoDB deployments are not affected. The vulnerability is present in the PostgreSQL adapter for any supported Node.js environment and is identified by the provided CPEs.

The vulnerability achieves a high CVSS score of 9.3, but its EPSS score is currently under 1 %, indicating a low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog, so no widespread exploitation has been reported. The attack vector is remote; an attacker needs the ability to issue write (increment) requests to the Parse Server REST API, which may be authenticated or unauthenticated, to inject arbitrary SQL statements.