Parse Server, an open‑source Node.js backend, had a flaw that allowed HTTP Range requests to skip the afterFind(Parse.File) trigger. The trigger normally enforces authorization checks such as requireUser, and without it an attacker is able to obtain files that should be protected. The vulnerability is a classic example of improper authorization validation (CWE‑285).

The issue affects parse-community’s Parse Server for all releases before 8.6.71 and before 9.7.1-alpha.1. It applies to installations that use storage adapters that support streaming, such as the default GridFS adapter, on any infrastructure capable of running Node.js.

The CVSS score of 8.2 indicates a high severity, and the EPSS score of less than 1% suggests the likelihood of exploitation is currently low, though the vulnerability is not listed in the KEV catalog. Attackers can trigger the vulnerability remotely by sending a Range-header based download request to a file that is normally gated by an afterFind trigger. If successful, the attacker gains read access to protected files, compromising confidentiality and potentially enabling further exploitation.