Parse Server's GraphQL API endpoint omitted respect for the allowOrigin server option in versions prior to 8.6.66 and 9.7.0‑alpha.10. As a result, any web page could set its Origin header to any value and the server answered with the appropriate CORS headers, effectively permitting cross‑origin requests from any website. This bypasses the operator‑configured origin restrictions that are intended to limit which domains may interact with the Parse Server API. Though the REST API correctly enforces these restrictions, the GraphQL endpoint does not, allowing malicious sites to use browser‑based requests to access or manipulate data through GraphQL queries if the user has been authenticated or the data is publicly exposed.

The vulnerability affects the open‑source Parse Server from the parse-community project. All releases before version 8.6.66 and before the 9.7.0‑alpha.10 release are vulnerable. The affected environment is any deployment of Parse Server on Node.js that relies on the GraphQL API endpoint without a custom proxy or firewall configuration.

The severity score is CVSS 5.3, indicating a moderate level of risk, while the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically exploit the issue by hosting a malicious web page that sends cross‑origin requests the GraphQL endpoint, potentially exfiltrating data or performing unauthorized actions if authentication mechanisms are bypassed or weak. The available patch in versions 8.6.66 and 9.7.0‑alpha.10 removes the logic that ignores the allowOrigin setting, restoring proper CORS enforcement.