Parse Server’s routeAllowList feature is meant to restrict external clients to a predefined list of REST API routes. The enforcement is performed only as Express middleware that examines the outer HTTP request URL. When a caller issues a request to the /batch endpoint, the server dispatches each sub‑request internally to the router without re‑applying the allow‑list check. This allows an attacker to send batch sub‑requests that target routes omitted from the allow‑list, granting access to API endpoints that the operator intended to block. Authentication, ACL, and CLP controls are still enforced on the inner routes, so the attacker does not automatically gain full privileges, but the operator‑defined route firewall is bypassed, potentially exposing or modifying data if the inner authorizations are insufficient. The likely attack vector is sending an HTTP request to the /batch endpoint with crafted sub‑requests.

The vulnerability affects the parse-community Parse Server product. Versions ranging from 9.8.0 up to but excluding 9.9.1‑alpha.3, when deployed on any Node.js‑capable infrastructure, are susceptible.

The CVSS score of 6.9 places this flaw in the medium range, and the EPSS score of less than 1% indicates a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to reach the server remotely over HTTP, know the API surface, and construct a batch payload targeting omitted routes. The internal authentication and ACL layers remain active, but the bypassed route firewall can expose or alter data if those controls are not stringent. Despite the low exploitation likelihood, the potential impact of unauthorized access to protected API routes warrants prompt remediation.