Most recent entries from all

BIT-parse-2024-47183 — Parse Server's custom object ID allows to acquire role privileges

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

EUVD-2026-192431

fkie_cve-2024-47183

GHSA-8xq9-g7ch-35hg — Parse Server's custom object ID allows to acquire role privileges

Affected: npm: parse-server

### Impact

If the Parse Server option `allowCustomObjectId: true` is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.

### Patches

Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.

### Workarounds

- Disable custom object IDs by setting `allowCustomObjectId: false` or not setting the option which defaults to `false`. - Use a Cloud Code Trigger to validate that a new user's object ID doesn't start with the prefix `role:`.

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg - https://github.com/parse-community/parse-server/pull/9317 (fix for Parse Server 7) - https://github.com/parse-community/parse-server/pull/9318 (fix for Parse Server 6)